search

360netlab / DGA

Suspicious DGA from PDNS and Sandbox.
MIT License
182 stars 35 forks source link

From PDNS: Another fix length of 7, a-z. tlds: [ru, com] #36

Open suqitian opened 7 years ago

suqitian commented 7 years ago
suqitian commented 7 years ago
phunterlau commented 7 years ago

some new waves are observed recently with ru only TLD, all query type A. For example, the core domains are like these, detected with very strong correlation, no subdomains:

date -u
Tue Oct 17 22:10:20 UTC 2017

bhzlyxh.ru.,1
qsxxzni.ru.,1
gwjijru.ru.,1
fyxkmbh.ru.,1
qwoumzw.ru.,1
kulfxxy.ru.,1
nrxboty.ru.,1
pyjhhpx.ru.,1
qwwzlam.ru.,1
sbckhnb.ru.,1
yboqlxs.ru.,1
qyccsug.ru.,1
nmtydik.ru.,1
uzpadrm.ru.,1
dqoudex.ru.,1
ssopuyk.ru.,1
gqlgpob.ru.,1
fgqjwdl.ru.,1
tdmxpmi.ru.,1
rxzyglt.ru.,1
qmwekpe.ru.,1
reczrhm.ru.,1
diacfxa.ru.,1
neffcrf.ru.,1
qhrywlc.ru.,1
hmiwbxq.ru.,1
wyudsya.ru.,1
lyfsnwj.ru.,1
kmgcsug.ru.,1

meanwhile, the wasyellowindexhotel.ru has many new FQDNs like w1.wasyellowindexhotel.ru w17.wasyellowindexhotel.ru w18.wasyellowindexhotel.ru. An educated guess can lead to some new variant.

baderj commented 6 years ago

There is a DGA in the binary. It generates a new domain every 10 seconds

void __stdcall __noreturn query_fake_domains(LPVOID lpThreadParameter)
{
  signed int i; // esi@1
  int attempts; // esi@3
  CHAR full_domain; // [esp+4h] [ebp-80h]@4
  char domain[4]; // [esp+44h] [ebp-40h]@2

  while ( 1 )
  {
    do
    {
      i = 0;
      do
        domain[i++] = rand() % 25 + 'a';
      while ( i < 7 );
      *&domain[i] = 'ur.';
      attempts = 0;
    }
    while ( number_of_resolves <= 0 );
    do
    {
      wsprintfA(&full_domain, pFakeDomainPattern, attempts, domain);
      if ( inet_addr(domain) == -1 && !gethostbyname(domain) )
        Sleep(1000u);
      Sleep(10000u);
      ++attempts;
    }
    while ( attempts < number_of_resolves );
  }
}

https://imgur.com/a/GU5ti

The PRNG is seeded with GetTickCount and the domains are therefore not predictable. The domains look like the hardcoded domains though, and I think they are used as decoys.

suqitian commented 6 years ago

Hi Bader, thanks for pointing this out, also thanks for sharing so many DGA implementation at GitHub :)

phunterlau commented 6 years ago

@baderj thanks for sharing this DGA. We see many of them are resolved in our DNS traffic, which may not look like decoys. Do you have further analysis of this malware? Thanks.

ptresearch commented 6 years ago

Hello @baderj

Could you please share the hash or even sample from which this DGA is?

baderj commented 6 years ago

I looked at this sample

md5:    f2ebc1ee228298f149eff64cc2548f03
sha1:   c51a8db70986c21b44d3e78b092e0e29102f857c
sha256: 11fc02dd825c8e67d58cc40a47e3f4c572097bd58c6aae80591a5fb73b9167f2

It unpacks to

md5:    d0be78dc1e0a109bb8e1d80665819c9a
sha1:   4d67f2b80bcce6f7042203fc9be96f10da90dc0f
sha256: 029e1a73abd9b9b741ec2a051f5ae3329b4ec3780f9690a73aab2e2c6f965fbe

Sorry I wasn't clear in my first comment: There is a large list of hardcoded domains with ports that the malware contact. But in addition to that, there is a DGA that generates domains that look exactly like the hardcoded domains. The seeding of the DGA is done with GetTickCount and therefore unpredictable. Those DGA domains are generated every 10 seconds.

suqitian commented 6 years ago

Finding an analysis article on this issue, unfortunately, is in Chinese. http[:]//www.freebuf.com/column/153424.html Also found another hash with this DGA:

MD5:      54b5e6ae6a4eb6139b10d4ad25df32c2
SHA1:     9f479661020ccb94792315b2ae07738bdb4912cb
SHA256: 4cef263eba381523aa3ad23235e9d512028f41466f2ad1f4319ea4aa8c4d562d