xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection
xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.
Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.
- CASHY200 is a PowerShell backdoor using DNS tunneling for C2
- DNS security blocked the tunnel at a Kuwait organization in September 2019
- Word documents observed delivering CASHY200 to Kuwait government targets
- Sample lineage shows active development from at least May 2018
- Overlapping domains tie CASHY200 to known Sakabota C2 infrastructure
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | firewallsupports.com | hat communicated with the domains windows-updates[.]com and firewallsupports[.]com , respectively. We do not have telemetry to determine the |
| domain | indows64x.com | observed one of these overlapping domains, specifically, w indows64x[.]com , being used as the C2 server for a new PowerShell based |
| domain | pasta58.com | unt campaign , we observed several domains with ties to the pasta58[.]com domain associated with known Sakabota command and control |
| domain | windows64x.com | er 2019 we observed a host based in Kuwait beaconing to the windows64x[.]com domain using the same DNS tunneling protocol as the CASHY |
| domain | windows-updates.com | HY200 PowerShell scripts that communicated with the domains windows-updates[.]com and firewallsupports[.]com , respectively. We do not have |
| domain | winx64-microsoft.com | ts seen installing CASHY200, which shows another C2 domain, winx64-microsoft[.]com , used by this threat group. Modified time SHA256 Filenam |
| ipv4 | 119.104.111.97 | C2 server answers these two queries with the IPv4 addresses 119.104.111.97 and 109.105.0.0 , which CASHY200 processes by treating each |
| ipv4 | 1.2.3.4 | ure 4 shows the DNS server responding to these queries with 1.2.3.4 , which is just a placeholder we included in our C2 server |
| sha256 | eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3 | HY200 DNS Tunneling Protocol We analyzed the file ( SHA256: eccc65711cbd154f680e8c8ef343d53f29e4a6237510abd4ad1eab5742b035b3) in order to understand the capabilities of the payload and |
From the original article
13 min read at unit42.paloaltonetworks.com
During our continued analysis of the xHunt campaign , we observed several domains with ties to the pasta58[.] com domain associated with known Sakabota command and control (C2) activity. In June 2019, we observed one of these overlapping domains, specifically, w indows64x[.]
By Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.