Forest Global Training Partners

Cyber Risks · Cisco Talos

Decoding Domain Generation Algorithms (DGAs) Part III - Zeus Bot DGA Reproduction

Summary: Cisco Talos reverse-engineered the ZeusBot DGA by breaking on InternetConnectA in WinINet.dll after the malware's injection into explorer.exe, tracing a connectivity check against Google (or Bing) that runs twice before the DGA fires. The DGA builds seven bytes from the last byte of the year plus 30h, the month, the day rounded down to a multiple of 7, and a two-byte seed derived from QueryPerformanceCounter or GetTickCount and reduced mod 1000, hashes them with MD5, and turns the hash into a domain plus one of six TLDs (.ru, .biz, .info, .org, .net, .com).

What's compelling: The seed space is only 1000 domains per day, and at roughly one lookup per second the attacker can walk the entire list in about 16 minutes - so a defender who can enumerate the same 1000 names from the date alone has a short, fixed window to block or sinkhole the rendezvous before the bot calls home.

Read the original at Cisco Talos ↗

Topics
Malware
Related