T1071.004 DNS in real malware
ATT&CK technique T1071.004 DNS appears in 21 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is falling (1 recent vs 7 prior). Most associated families: Yogi, Acnu, Dlof, Dmpo, Dmww.
Tactics: command-and-control
Prevalence in the corpus
- Samples exhibiting T1071.004: 21
- Share of analyzed corpus: 0.0%
- Last 7 days: 1 · prior 7 days: 7 (falling)
Malware families using T1071.004
Example samples
- 22eaab70c1736c3e02814209323324643853d9a40c3d04b8c6ad1838e20687e9 - malicious
- 3e497c4592235f88cca567e99819a0a1dfd7c48cf58e409accafe298abe02cbf.exe - suspicious
- d9f54d09755246ee1e57a12f63cdb41b8e195c9576b8e47dc2190d4cefa86032 - suspicious
- 3d6b24a04634f0f724a119d596491942f281f7fd4c36aea10daf427c91fb93fa.exe - malicious
- 3d017e38a7f64f59bcfff462d68327a0237823e8c43979d52bb366b5324b987e.exe - malicious
- 373ca0a0e89006ec968611fb0c15a569e3c12f338292df69fbeba45d0db37828.exe - malicious
- 360e3d2fb3c31a9341c340b12f603bdfc43d5d4ecda29cb5c113656d72a216c8.exe - suspicious
- 2c121d5cf9a6dd3bd87400ac8e4589eaca64ffa9b5f9f8fd033d49a6282787f0.exe - suspicious
- 2620d70c77a42d99ac951267e8ce50aff532a2bbdb4a03d88e173b6e1af9652f.exe - suspicious
- 21b43f5fb1128d91a1caf0807911382d94577bee6cf28c25ce4885ad811f89f2.exe - malicious
- 1ca943f06c188ce8b99c66c64b1893e24d96f3efe1bcbb38df76d9a86a1f551f.exe - malicious
- 1c5e5e58576393aae2f72813cc01e78c1578ccd15aabd8b3c266a188c6e6250e.exe - suspicious
- 148542b43fd6db8047c825ad9b976b8e9ce35619e2406caddd1e530fe6769023.exe - suspicious
- 114af183c67375bcfcde05b6e3424636cc6c447e46da61e27612ff12866d0351.exe - malicious
- 0abea2b6c8c64ccbc60062294947dc2a21b9c78a1f76c7b97350ad15a0575571.exe - malicious
- 09edfcfd964c4d696bf31fd73a2a25cf202ada11e3c2d6e1c7972e8ecbe4bd48.exe - malicious
- 074709ffa3c0e629e5c17a7c0d8235d68606eb06d13525dfbf008d14dcbb8508.exe - malicious
- 055fb724333f4651eb7507c6d8c9df57c85f4ad498768c0f701e130a0c3b8cae.exe - malicious
- 05696df094461a8c9e3cb3f2154b3bee656147fb2b631626250e9ae96665014c.exe - malicious
- 03f6840b488880b25f68ef287fa4f690297d940307c23c33d50571b9a4c33913.exe - malicious
- virussign.com_d113f05fea5d484a6475862bb71c9720.vir - malicious
Canonical technique definition: MITRE ATT&CK T1071.004 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1071.004
- How common is ATT&CK T1071.004 (DNS) in real malware?
- ATT&CK technique T1071.004 DNS appears in 21 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is falling (1 recent vs 7 prior). Most associated families: Yogi, Acnu, Dlof, Dmpo, Dmww.
- Is T1071.004 becoming more common?
- Prevalence is falling: 1 sample in the last seven days against 7 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1071.004?
- In this corpus T1071.004 is most associated with Yogi (3), Acnu (1), Dlof (1), Dmpo (1), Dmww (1), Dnpb (1). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1071.004?
- 0.0% of the publicly analyzed corpus (21 of 100981 samples) exhibits T1071.004. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats