Skip to content
MalwareWiki

Malware

DNSMessenger

aka TEXTMATE

DNSMessenger makes use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel.

DNSMessenger, also known as TEXTMATE, is a Windows malware family operated by Anunak.

Background

DNSMessenger establishes a two-way Command and Control (C2) channel by leveraging DNS TXT record queries and their responses. By tunneling over DNS in this way, an attacker can push new commands to infected hosts and retrieve the output of those commands.

Source: Malpedia (Fraunhofer FKIE).