#ekstak — Public Fediverse posts

Here’s an example where the bot attempts to resolve the C2 hostname using all the hard coded name servers, but fails. It then falls back to querying bddns[.]cc over HTTP to resolve the IP address of the C2 server, which works out. The second screenshot shows the bot's c=94bf3661c794e3eb1ba4 checkin command.

The PCAP is from an execution of a malicious EXE (MD5 55a14f9e05962654f774b8129ec4c2ca) on any.run.

Most AV vendors label this malware as #zusy, #ekstak or #staser