Giters

360netlab / DGA

Suspicious DGA from PDNS and Sandbox.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Susp DGA from PDNS: A fix length of 16, mix a-z and 0-9, tlds: [org, ru, cn, net, info, biz]

suqitian opened this issue · comments

commented
  • MD5
    55c447191d9566c7442e25c4caf0d2fe
  • These suspicious domains had been noticed for a long time from PDNS system, but until weeks ago, we found a new method to map these domains to the target MD5. Domains sampled on Aug 07, 2016:
    53ptxfec6a4mwbrl.org
    ou16nagv4pashauc.ru
    cav36gi2q7sw1quk.cn
    vnbbj9a2udxpfq2c.cn
    fqtk3dzc23momnpg.org
    4w30kxhvkfel0oup.net
    9n78kfujyzmip0qv.info
    w2ot29dbfzg6keue.ru
    d9tan26jpjpz9snt.cn
    guf7vdg5eutsacyj.ru
    l1sfcoafyl7x1gkr.biz
    jq1i45ll407n59fi.info
    p5oaqfyxb94yig2t.org
    9q02paxvmei1v6sp.ru
    jayzvrpixxlc58bc.info
    eseu24pzdd5f72vv.biz
    dcydfwpx6g5to34s.cn
    ydd3i2lh6afrfmw1.ru
  • Malware sample[ 55c447191d9566c7442e25c4caf0d2fe] DNS queries, very similar to those domains in the list above.
    0aa05rcmqxnz7vzj.net
    29cqdf6obnq462yv.com
    2s3txyhr1ptozde7.info
    5qip6brukxyf9lhk.ru
    7vzlqhsisdgk1diw.net
    8ccl6qveudd642rq.ru
    etkxskxjy8sn4niz.ru
    gkczbuwjza2s1khf.net
    nhamoigj5jd1qyn4.cn
    o47xa659ueqorz57.org
    p7rmkau94thlq1tb.cn
    qowhi81jvoid4j0m.biz
    tjklzgosi2xivjs4.biz
    zinna4ltt9yx9bih.com
    0aa05rcmqxnz7vzj.net
    29cqdf6obnq462yv.com
    2s3txyhr1ptozde7.info
    5qip6brukxyf9lhk.ru
    7vzlqhsisdgk1diw.net
    8ccl6qveudd642rq.ru
    dahs7d52v40cyxgi.info
    etkxskxjy8sn4niz.ru
    gkczbuwjza2s1khf.net
    gnjvn08gxgd2u6dh.info
    nhamoigj5jd1qyn4.cn
    o47xa659ueqorz57.org
    p7rmkau94thlq1tb.cn
    qowhi81jvoid4j0m.biz
  • So, really looking forward to reverse engineer this binary and feed back the implementation of DGA, then we can filter out these malicious domains in PDNS system.
commented

Some details about this malware:
https://blog.malwarebytes.com/threat-analysis/2015/06/unusual-exploit-kit-targets-chinese-users-part-2/

Run this sample in my virtualbox, it drop a file named 4VJzegtSr.exe into path C:\Windows\system\JkLtFzICS.
Double click 4VJzegtSr.exe, wait for a minutes, hundreds of domains will be seen in wireshark.

commented

The DGA of Chinad
1000 domains per day

Test:

$ date +%s -d "2016-08-7 12:00:00"  
1470542400
$ python dga.py -t 1470542400 -n 1000 -l 16 | less
...
53ptxfec6a4mwbrl.org
gyzn61atzscg0uik.info
9j5k16z7x0zdh1ro.net
...
ou16nagv4pashauc.ru
neblb4lwt5jknbo4.com
uknvzqus9y71mo1y.info
...

The output are well-matched to those domains which observed from PDNS on Aug 07, 2016.
And file dga.py is here.