Threats Tagged 'modular architecture'

A TrickBot malware variant has been identified that uses DNS tunneling for command-and-control (C2) communications, bypassing traditional HTTP channels. It persists on infected Windows systems by creating disguised scheduled tasks that run at startup and every five minutes. Configuration data is hidden in NTFS Alternate Data Streams to evade detection. The malware uses multiple obfuscation methods, including encrypted strings and runtime API resolution, and supports a modular architecture with twelve control commands enabling advanced capabilities such as module downloads, process injection via hollowing and doppelgänging, PowerShell execution, and raw machine code execution. Data transfer occurs through crafted DNS queries to public DNS servers, encoding commands in malformed domain names and receiving responses in multiple IPv4 addresses, achieving transfer speeds of about 30.7 KB/s.