dnscat2 | 24153213[.]exe

Resubmissions

10-07-2022 13:10

220710-qegsxsbegq 10

07-07-2022 11:57

220707-n4mz5aaab9 10

06-07-2022 06:48

220706-hk3nksbgd6 1

Sharing

Copy URL

Twitter E-mail

General

Target

24153213.exe
Size

134KB
MD5

c7663b8a29eded725daedaa084d752cf
SHA1

ff577394d709148ba6477a1513679cbe30deaaed
SHA256

c79098fe60d162d312f798aece330c83ac93eb12c1fb9cc6c9efc9f66d662b6c
SHA512

97b99331c427257c3a97a2e3604eb731c8302a86cd2707518069d90b0315ebacf5735adb53f67a4fbfa86ddc91f78228e476a791788adf0dd60e0adc90c49fe0
SSDEEP

3072:ERx7CEBfH1GlyCjRqa6tol3XW4IkTeb350SA:qMEz+jRn6tolTTeb2

Score

10^/10

dnscat2

Malware Config

Signatures

Detects dnscat2 1 IoCs

Processes:

resource yara_rule

sample tool_dnscat2
Dnscat2 family
dnscat2

resource	yara_rule
sample	tool_dnscat2

Files

24153213.exe
.exe windows x86

26358c1b6f9d807c5408f9d711aef20a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
sendto
WSAGetLastError
WSAStartup
inet_addr
bind
socket
closesocket
gethostbyname
gethostname
inet_ntoa
recvfrom
select
ntohs
recv
__WSAFDIsSet
WSAStringToAddressA
htonl
htons

dnsapi

DnsQueryConfig

kernel32

GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
WriteConsoleW
WriteConsoleA
SetStdHandle
CreateFileA
SetFilePointer
GetLocaleInfoA
CompareStringW
GetCurrentProcessId
GetTickCount
GetConsoleOutputCP
CompareStringA
WriteFile
CreateProcessA
TerminateProcess
CreatePipe
CloseHandle
PeekNamedPipe
Sleep
ReadFile
GetStdHandle
GetLastError
CreateThread
GetSystemTimeAsFileTime
FormatMessageA
SetEnvironmentVariableA
SetEndOfFile
FlushFileBuffers
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
ExitProcess
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameA
SetHandleCount
GetProcessHeap
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetFullPathNameA
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

26358c1b6f9d807c5408f9d711aef20a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dnsapi

kernel32

advapi32

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 6KB