S1021 DnsSystem

malwareEnterprise

platformsWindows

also known asDnsSystem

DnsSystem is a.NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by HEXANE since at least June 2022.

techniques used (9)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1033System Owner/User Discovery
T1041Exfiltration Over C2 Channel
T1059.003Windows Command Shell
T1071.004DNS
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1204.002Malicious File
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G1001HEXANE

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan