DNSMessenger - C2 Commands via DNS TXT record

The use of the DNS TXT record for Command and Control (C2) communications is not new, but it is an uncommon method for Remote Access Trojans.

The malware is being delivered via spam emails in an attached macro-enabled word document which purports to be secured by McAfee.

If the victim opened the document and activated the content, a VBA script uses the Document_Open() function to unpack a PowerShell script and execute it. The unpacked script contains instructions that are used to maintain persistence and other operations. The malware would then contact a domain and extract the DNS TXT record which contains a Base64 encoded PowerShell command that loads components into memory.

In the initial analysis of the malware, it was found that there was a Base64 encoded string ‘SourceFireSux’. Source Fire is a Cisco owned company that offers IDS/IPS and next generation firewall services which are designed to protect organisations from DNS and web based threats.

DNSMessenger never writes any malicious code to disk, making detection more difficult.

All of the C2 domains used the following Top Level Domains (TLD); .me, .pw, .club, .us, .site, .com, .top, and .info. All of the domains consisted of either 4 or 5

random characters. At the time of writing, the domains were no longer active and the malware will be using new unknown Command and Control (C2) Servers.