FortiGuard researchers captured malicious samples that sent malformed DNS queries and identified them as TrickBot variants.
Unlike older TrickBot campaigns that mainly used HTTP for command-and-control communications, this version hides its traffic in DNS requests and responses.
TrickBot is a modular malware family that can download extra components after infecting a device. This design lets operators add features such as command execution, PowerShell activity, module downloads, and process injection.
The newly analyzed samples were 646464-bit Windows executables with different hashes but matching PE characteristics, startup routines, and behavior, indicating a shared campaign.
The malware also uses multiple anti-analysis methods. It encrypts hard-coded strings, including DLL names such as Kernel32.dll. It decrypts them only at runtime using operations such as XOR and subtraction.
It dynamically calculates many constant values and resolves Windows API functions through hashes rather than storing readable API names.
For example, the malware uses a hash-based API resolver to locate LoadLibraryA, then loads Kernel32.dll.
This technique complicates static detection and reverse engineering because analysts cannot simply inspect imported functions or readable strings.
TrickBot Masquerades as Wireshark Update
The TrickBot variant creates persistence through Windows Task Scheduler. When launched without parameters, or without its -u option, the malware creates a scheduled task that executes every five minutes and also runs when the device starts.
Its task name combines a randomly selected folder name from the %AppData% directory, the text autoupdate #, and a random number.
One observed example was Wireshark autoupdate #72784, designed to look like a legitimate Wireshark software update.
The task launches the TrickBot executable with the -u parameter. The malware creates it through the Schedule.Service.1 COM automation object and configures its name, action, startup trigger, and repeat interval.
To avoid creating duplicate tasks, TrickBot saves the task name and full executable path in NTFS Alternate Data Streams.
The $TASK stream stores the Base64-encoded task name, while $FILE contains the Base64-encoded path to the malware. On later runs, it retrieves and decodes this information before rebuilding or checking the existing task.
Once started with -u, TrickBot communicates with its command-and-control infrastructure through DNS tunneling.
It encrypts control data with the XOR key 0xB9, converts it to hexadecimal, splits the result into DNS-compatible labels, and appends the data to the domain westurn. in.
It then uses getaddrinfo() to transmit malformed DNS requests through public resolvers, including 8.8.8.8, fortinet said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| C2 Domain | westurn.in | TrickBot DNS tunneling command-and-control domain |
| Scheduled Task Pattern | Wireshark autoupdate #<random_number> | Task Scheduler persistence disguised as a Wireshark update |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
