Anatomy of a Fake “DNS Optimizer”

Anatomy of a Fake "DNS Optimizer" — teardown of DNS一键优化.exe

Category: Software & Security · Status: Done · Type: Defensive reverse engineering

A 3.6 MB Windows program called DNS一键优化.exe ("one-click DNS optimization") is handed to users by an online gambling portal as a fix for "the game won't open / black screen". It looks like a friendly support utility. It is actually an unsigned, administrator-level tool that rewrites the DNS servers on every network adapter in Windows, published by the operator of the site you were trying to unblock. This is the full teardown: what it does, what it does not do, and why the answer is still "don't run it".

Stack / Tools: Python (PE/resource parsing) · UPX (built from source) · Qt/MinGW binary analysis · macOS provenance (xattr) · HTML write-up

Artifacts on the site:

• demos/exe-teardown.html — the published write-up (self-contained, dark/light)
• demos/dns-exe-icon.png — the sample's own icon, extracted from its .rsrc
• this file — the build spec / method notes

Verdict

Not a password stealer — and still not safe. No spyware, no backdoor, no payload. It is an unsigned, unversioned, administrator-level utility whose entire function is to replace your DNS servers, and it arrives from an unlicensed gambling operation as part of an access-bypass kit. The risk is not a hidden virus; it is who is handing you an admin-level network tool, and what that tool is permitted to point your traffic at.

1 — Provenance (no guessing required)

macOS records the source of every download in an extended attribute:

$ xattr -l DNS一键优化.exe
com.apple.metadata:kMDItemWhereFroms: https://www.218yc.com/static/file/DNS一键优化.exe
                                     https://www.218yc.com/
com.apple.quarantine: 0081;6aae4c6a;Chrome;67742DF8-97D5-48D8-9C09-BB275F6181D3

218yc.com is a search-engine-camouflaged portal for an unlicensed gambling operation — scraped news snippets, bank and email links for legitimacy, and links into browser-based casino games. Its help page offers a three-item "self-rescue" kit: ① 一键优化修改DNS (this file), ② 寰宇浏览器 (a promoted "goes anywhere" browser), ③ a line-check tool. All three exist to make a blocked site load.

2 — File facts

The manifest is stored uncompressed even inside a packed PE, so it is readable without unpacking:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

No signature + no version resource + admin demand = a throwaway build nobody can be held to.

3 — The whole program, in four lines

Application class names are UDnsOptimizer / UDnsWindow. Its working code wraps Windows' own network CLI:

netsh interface ip   set dns "%1" static %2
netsh interface ip   add dns "%1" %2 index=2
netsh interface ipv4 set dnsserver "%1" static %2
netsh interface ip   set dns "%1" dhcp          // "reset to automatic"

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%1 → NameServer

The UI it presents is a single button, with these strings:

DNS 设置尚未优化 · 按下 "优化" 按键, 以优化 DNS 服务器的设置。 · DNS 设定中… · DNS 设置已优化 · DNS 优化失败

The only DNS server addresses anywhere in the binary are 8.8.8.8 and 8.8.4.4 — Google Public DNS. There is no latency test and no provider comparison, so "optimize" means exactly one thing: replace your ISP's resolvers with Google's.

It also carries hidden command-line options — --adapter-index, --preferred-dns-server, --alternate-dns-server — and programmatic entry points such as setAllDnsAddressManually(). Whoever launches it can aim your DNS at any resolver they choose, elevated, on every adapter.

4 — Why a gambling site ships a DNS tool

DNS is usually what blocks it. Casino domains are commonly sinkholed at the DNS layer (notably on mainland ISP resolvers), so the site simply won't resolve. The standard workaround is a foreign resolver plus a proxy-capable browser — which is exactly the three-item kit on the help page. The tool is not random; it is step one of a documented access-bypass workflow, dressed up as consumer-friendly "one-click" support.

5 — What was not found (kept deliberately honest)

• No C2 or network behaviour: no InternetOpen, URLDownloadToFile or WinHttpConnect; no

embedded URLs or IP endpoints beyond Qt library text.

• No persistence: no Run keys, scheduled tasks, services or startup-folder drops.
• No second stage: no dropped files, no appended overlay beyond the packed image.
• No hosts-file edit, no proxy reconfiguration, no UAC tampering (it only reads the UAC state

and can open the UAC settings panel).

• The scary-looking strings (\\.\lnk, NetShareEnum, UNC paths) are Qt/Windows shell library

strings present in every Qt app — a classic false positive.

"No payload" is a statement about this build, today. You are still granting administrator rights to an unsigned, unversioned binary from an unlicensed gambling operator with no support channel and no update path — and trojanising an update to a tool people already trust is the ordinary way this pattern turns bad later.

6 — Why you shouldn't run it (five reasons)

1. Unverifiable authorship, with admin rights. No signature, no version info, no publisher;

you cannot distinguish this build from a modified one.

2. It rewrites every adapter, and rollback is on you. Changes are applied per adapter and

written to the registry. A partial failure or a VPN/school/work profile with its own resolver leaves you with broken name resolution and only a blunt "set it back to automatic".

3. It silently redirects all DNS traffic to a third party. A real privacy change, and it

commonly breaks split-horizon internal DNS, captive portals, and ISP/parental/campus filtering.

4. **It can be aimed at any resolver by whoever runs it.** The --preferred-dns-server /

--alternate-dns-server switches make it a generic DNS-setting engine that a launcher can drive to a malicious resolver without any prompt — and DNS decides where traffic goes.

5. Provenance is disqualifying. Distributed by an unlicensed gambling operation from a

disguised pseudo-news domain, as part of a workflow whose purpose is evading network controls.

7 — The pattern to recognise next time

• Pushed by the site you were trying to reach, rather than by a vendor.
• An unsigned binary asking for administrator rights.
• No version info at all — nobody intends to be held to it.
• The "fix" is actually a bypass: "fixes the black screen", "works anywhere", "unblocks the game".
• A browser bundled with the fix — a network setting change plus a vendor-controlled browser

are the two halves of a traffic-redirection kit.

8 — Method (static analysis only)

Notes worth keeping:

• A naive byte-pair "GBK" regex over a binary yields ~22k false positives; require successful

UTF-8 decoding and a CJK run.

• brew install upx | tail -5 masks the real exit code — the pipeline returns tail's status.
• Don't pass -DCMAKE_OSX_ARCHITECTURES=arm64 when building UPX here; it triggers the same

x86_64 libxcrun failure. Pin CMAKE_C_COMPILER/CMAKE_CXX_COMPILER instead.

9 — Indicators

10 — If it was already run on a Windows machine

:: see current DNS servers per adapter
netsh interface ip show dns

:: revert an adapter to the network's own resolvers
netsh interface ip set dns "Wi-Fi" dhcp
netsh interface ip set dns "Ethernet" dhcp

Then confirm the NameServer values under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ are empty/automatic.

The sample is deliberately not hosted on this site. To get a scanner's opinion, submit the hashes above to a service such as VirusTotal instead of running the file.

Scope note

Static analysis of one sample, identified by the hashes above. No dynamic execution was performed (a Windows PE cannot run on the analysing macOS host). Findings describe this build; they are not a general claim about every "DNS optimizer". Analysed 19 Sep 2026 · published 8 Oct 2026.