dnscat2 | wer5645utyu

Resubmissions

07-07-2022 11:56

220707-n37yxagafm 10

06-07-2022 06:47

220706-hkhneahhaq 1

Sharing

Copy URL

Twitter E-mail

General

Target

wer5645utyu
Size

114KB
MD5

80318534ad9958ef6cecebe15554e453
SHA1

ba188715b4e86a387031e0684c7fa4539c027c5c
SHA256

e32ab1ce4f127da9915f957415e70d13db2f4bc0a8c1d8e45a85e6dfcb42b683
SHA512

75a840539b3e37530cbbd6f555c59458fed82b1c09efd87b3e4e8cb1cbf49aca2f615afa7f083b04bd5b7308fbd895a1e80854a3298e8d6bac971931c7ddd337
SSDEEP

1536:7gEHtnBJSkMSuTaOw7WWdWWfpz1sNVal9YXbRwu+BKaZQ0fe3Te6qzkiJQ5iAWo:7DH/IkMhTAlJsLA9MbUfe3TetRQ5zW

Score

10^/10

dnscat2

Malware Config

Signatures

Detects dnscat2 1 IoCs

resource	yara_rule
sample	tool_dnscat2

Dnscat2 family
dnscat2

Files

wer5645utyu
.exe windows x86

d51c0a3c6c4d981b3f27c3cb495a760e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
sendto
WSAGetLastError
WSAStartup
inet_addr
bind
socket
closesocket
gethostbyname
inet_ntoa
recvfrom
select
ntohs
recv
__WSAFDIsSet
WSAStringToAddressA
htonl
htons

dnsapi

DnsQueryConfig

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
SetFilePointer
GetLocaleInfoA
GetTimeZoneInformation
TlsGetValue
WriteFile
CreateProcessA
TerminateProcess
CreatePipe
CloseHandle
PeekNamedPipe
Sleep
ReadFile
GetStdHandle
GetLastError
CreateThread
GetSystemTimeAsFileTime
FormatMessageA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
ExitProcess
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcessHeap
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetFullPathNameA
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
FlushFileBuffers

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

d51c0a3c6c4d981b3f27c3cb495a760e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dnsapi

kernel32

Sections

.text Size: 83KB - Virtual size: 82KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 83KB - Virtual size: 82KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 5KB