Do Son 
At a Glance
| Malware family | TrickBot (modular Windows banking trojan and loader) |
| Threat actor | Not attributed by the vendor; no group named |
| Targets | Windows endpoints; victims not enumerated in the report |
| Delivery vector | Not documented; six samples captured from network telemetry |
| Key capabilities | DNS tunneling C2, scheduled-task persistence, module loading, process injection, shell and PowerShell execution |
| Source | FortiGuard Labs threat research |
TL;DR
FortiGuard Labs captured six TrickBot samples that reach their command server through DNS rather than HTTP. The variant buries encrypted command data inside malformed DNS queries, then reads the replies out of returned IP addresses. It also hides its own configuration in NTFS Alternate Data Streams.
Delivery and Sample Set
Researchers spotted the malware because of its network noise, not its files. Six executables shared identical PE characteristics, startup code, and behaviour despite different hashes. Each is a 64-bit Windows binary of roughly 663 KB, and none use a packer.
The write-up does not document how the samples reached victim machines. Victim counts also stay unpublished.
Attribution Status
No confirmed attribution exists. Fortinet names no actor and no country. The shared code traits only support a suspected link between the six samples and one campaign.
Context helps, though. The campaign string embedded in the C2 requests matches the Anchor_DNS module that researchers documented publicly years ago in TrickBot-linked intrusions.
Infection Chain
Anti-Analysis Layers
Constant strings arrive encrypted and unpack at runtime through simple arithmetic and XOR operations. Windows APIs never appear in the import table. Instead, the malware resolves each one through a hash lookup while running.
Persistence Through a Fake Updater
The sample builds a scheduled task through a Task Scheduler COM interface. It assembles the task name from a random folder name under %AppData%, an “autoupdate #” string, and a random number. In one run, “TrickBot disguises the scheduled task as an automatic Wireshark update.”
That task fires at startup and repeats every five minutes. The malware then stores the task name and its own path, Base64-encoded, in two NTFS Alternate Data Streams. On the next launch it reads those streams and rebuilds the same task, so duplicates never pile up.
Command-and-Control and Data Exfiltration
TrickBot DNS tunneling starts once the binary runs with its update flag. As Fortinet puts it, “DNS tunneling is a technique used to bypass network security controls.” Queries travel through a public resolver, so they blend into ordinary traffic.
How Requests Ride Outbound
The malware encrypts command data with a single-byte XOR key. It then hex-encodes the result, inserts a dot every 63 characters, and prepends the whole string to one hardcoded domain. Three packet types handle requests, response-size queries, and response data. A session UUID ties fragments together.
How Answers Come Back
The response side is the clever part of this malware C2 communication design. The server replies with dozens of A records, and each IPv4 address carries three bytes of payload. The top six bits of the first octet hold an ordering index, which lets the malware re-sort addresses that resolvers shuffle.
The first two addresses carry a data offset and the payload size. That leaves 61 usable addresses, or 183 bytes per response packet. Slow, yet workable: the researcher moved a 1.2 MB file in about 40 seconds, roughly 30.7 KB/s.
Operator Capabilities
The first request registers the host and sends the computer name, an OS string, and a hardware ID. Twelve response commands follow. Operators can run shell commands, download and execute EXE modules, load DLLs through rundll32.exe, inject code using process hollowing or process doppelgänging, run PowerShell through anonymous pipes, and execute raw machine code in memory.
Detection and Defense Guidance
- Log every DNS query and baseline normal volumes per host.
- Alert on long, high-entropy hexadecimal labels that sit near the 63-character limit.
- Flag A responses that return unusually large sets of addresses.
- Force endpoints through internal resolvers and block direct outbound port 53.
- Review scheduled tasks that imitate updater names and repeat every few minutes.
- Scan executables for unexpected Alternate Data Streams.
- Watch for rundll32.exe launching DLLs from temporary folders.
One quirk helps hunters. The malware reports Windows 10 hosts as “Windows 8” and hardcodes the public IP field as an all-zero address. Those errors give defenders a cheap string to hunt for in decoded tunnel traffic.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
