Malware Hides Payloads in DNS TXT Records to Retrieve a Final Payload
Summary
Huntress analyzed multi-stage malware that used obfuscated PowerShell and DNS-over-HTTPS TXT records to conceal data, select external servers, and retrieve a final payload.
Key points
- A Windows Scheduled Task launched a chain using renamed binaries and a disguised log file to extract and execute obfuscated PowerShell.
- The PowerShell payload queried dns[.]google[.]com over HTTPS for a TXT record associated with dmarc[.]jqueryupdatejs[.]com.
- The TXT response mimicked a DKIM signature; the malware split its Base64-like data on slashes and decoded nested Base64 strings.
- Decoded numeric strings represented IP addresses used to select external servers for downloading the final payload.
- The final payload installed a command-and-control stub; the researchers said server endpoints and payloads could be changed by the attacker.
- Huntress observed another sample with variations in filenames and the same general concealment approach.
Article Details
- Attack Vectors
- A scheduled task launched a VBScript command that used cmd.exe and a renamed executable to execute obfuscated PowerShell code.
- The PowerShell payload queried a TXT record for dmarc.jqueryupdatejs.com through Google’s DNS-over-HTTPS resolver; data embedded in the response was decoded to select an external server for the final payload.
- The malware used names resembling active services on the target system for a renamed mshta.exe, and a lowercase one-word name for a program masking powershell.exe.
- Defensive Notes
- Inspect scheduled tasks and commands that chain VBScript, cmd.exe, renamed executables, and PowerShell.
- Analyze suspicious files and encoded payloads through their layers; the article notes that human review and reverse engineering helped uncover the behavior.
- Review DNS-over-HTTPS activity and TXT-record queries for suspicious domains, since the payload was delivered in TXT response data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jqueryupdatejs[.]com | Suspicious domain whose TXT record was queried by the malware to retrieve embedded payload data. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload used obfuscated and encoded layers, including nested Base64 segments and delimiter-based decoding.T1053.005 · Scheduled TaskThe initial foothold was discovered through a Scheduled Task that launched the malware command.T1059.001 · PowerShellThe staged payload used PowerShell to reconstruct and execute code from the a.chk or p.lve file.T1071.004 · DNSThe malware retrieved payload data through a DNS TXT query made using DNS over HTTPS.T1105 · Ingress Tool TransferThe malware contacted an external server to download the final payload.T1140 · Deobfuscate/Decode Files or InformationThe malware decoded nested Base64 data from a TXT response to obtain numeric representations of external server addresses.