dnscat2 | f1c89ef7a3ccfee32d3c6ea621ae3627_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f1c89ef7a3ccfee32d3c6ea621ae3627_JaffaCakes118
Size

138KB
MD5

f1c89ef7a3ccfee32d3c6ea621ae3627
SHA1

76ed20e9d756431e7969bd2c2b94f96992adabc3
SHA256

bd62d6456f32411c1e0e1b56de165e9a517c82432608697bda075eaf3233ee43
SHA512

bd6db82e6ced97287ec44229be002cf7397b070a486cb8d1d10e99ac9668da308ba9ffa0fa3c694bc521d49f2ca79a803a153be570f2b10878c11f1de79eb9d7
SSDEEP

3072:l9Jd1IS4OPWKaBy+sJwu6QoaXqeDyNpkpjBTeEZ5Fii:ndISDlJwu6RaXqeDyNSTeE5

Score

10^/10

dnscat2

Malware Config

Signatures

Detects dnscat2 1 IoCs

Processes:

resource	yara_rule
sample	tool_dnscat2

Dnscat2 family
dnscat2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
f1c89ef7a3ccfee32d3c6ea621ae3627_JaffaCakes118

Files

f1c89ef7a3ccfee32d3c6ea621ae3627_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6cc406f0fcd735d3b92dfb5ad14feb73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ron\Desktop\dnscat2-master\client\win32\Release\dnscat2.pdb

Imports

ws2_32

setsockopt
sendto
WSAGetLastError
ioctlsocket
connect
WSAStartup
inet_addr
bind
socket
closesocket
gethostbyname
send
gethostname
inet_ntoa
recvfrom
select
ntohs
recv
__WSAFDIsSet
getsockopt
WSAStringToAddressA
htonl
htons

dnsapi

DnsQueryConfig

kernel32

GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
CompareStringW
CompareStringA
SetFilePointer
GetLocaleInfoA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
SetEnvironmentVariableA
WriteFile
CreateProcessA
TerminateProcess
CreatePipe
CloseHandle
PeekNamedPipe
Sleep
ReadFile
GetStdHandle
GetLastError
CreateThread
GetSystemTimeAsFileTime
FormatMessageA
SetEndOfFile
GetCurrentProcessId
SetHandleCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
ExitProcess
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentProcess
IsDebuggerPresent
GetModuleFileNameA
GetProcessHeap
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
WideCharToMultiByte
RtlUnwind
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
GetFullPathNameA
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6cc406f0fcd735d3b92dfb5ad14feb73

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

dnsapi

kernel32

advapi32

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 6KB