MalwarePublished 15 Dec 2025Updated 20 Oct 2026

Kunai Analysis Report · Malware Sample Abusing Open Recursive DNS for Exfiltration

Source CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Kunai Analysis Report - Malware Sample Abusing Open Recursive DNS for Exfiltration

Impact

The primary impact is unauthorized data exfiltration through open recursive DNS servers, which can lead to data leakage from compromised systems. There are no reports of active exploitation or direct system compromise beyond the exfiltration vector. The threat may evade detection by using DNS traffic, which is often allowed through firewalls.

Defensive guidance

Mitigation should focus on restricting access to open recursive DNS servers within the network and monitoring DNS traffic for unusual patterns. Since this is a malware behavior report rather than a vulnerability in software, remediation involves network configuration and monitoring rather than patching. No vendor advisory or official fix is provided.

Indicators of compromise

Domains 2

service.systemsvcs.com
service.systemsvcs.com

IP addresses 10

8.8.8.8
8.8.4.4
9.9.9.9
45.90.28.160
45.90.30.160
149.112.112.112
9.9.9.11
1.1.1.1
1.0.0.1
149.112.112.11

Hashes 4

9c44bc9373377831c45dd0ac2661a28e
b439749a581ac5a29b5c9d91fc092bf4ceaa76a4
320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759
a4e6614000d02dcaa8f18bf34f630f7b7c4c6b00bd4251144a961e67b4c5f71b42395910f678287b7b7b88beeb43692bfa9b618426117bdd2b4d8ebf54d6e309

Text 20

AF_INET
TCP
AF_INET
TCP
AF_INET
TCP
AF_INET
TCP
AF_INET
TCP

Port 10

Datetime 2

2025-12-15T10:44:44.964728+00:00
2025-12-15T10:44:44.965450+00:00

File 3

bb71e285-75ad-4682-8fe7-903b0742e3a0
activity-graph.svgsample activity graph
kunai.json.gzkunai logs for sample

Size in bytes 1

5976064

Float 1

6.0021875680609

Malware sample 1

bb71e285-75ad-4682-8fe7-903b0742e3a0|9c44bc9373377831c45dd0ac2661a28e

Community reviews

Loading reviews…