DGAs and cyber-criminals: a case study - Revision history

Eric.freyssinet: Text replacement - " damballa.com" to ""

2015-08-05T20:58:07Z

Text replacement - " damballa.com" to ""

← Older revision		Revision as of 20:58, 5 August 2015
Line 5:		Line 5:
	\|CCProtocol=P2P,		\|CCProtocol=P2P,
	\|Editor=Damballa		\|Editor=Damballa
	\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf ~~damballa.com~~ (pdf)		\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf (pdf)
	\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim		\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim
	\|Abstract=In recent years, Domain Generation Algorithms (DGAs) have evolved from a proof-of-concept technique, capable of bypassing legacy static reputation systems (e.g. Domain Blacklists), into full-featured stealth modules embedded within an increasing number of advanced and evasive commercial crimeware toolkits today. DGAs are also referred to as a form of “domain fluxing.”		\|Abstract=In recent years, Domain Generation Algorithms (DGAs) have evolved from a proof-of-concept technique, capable of bypassing legacy static reputation systems (e.g. Domain Blacklists), into full-featured stealth modules embedded within an increasing number of advanced and evasive commercial crimeware toolkits today. DGAs are also referred to as a form of “domain fluxing.”
	This case study details how Damballa Labs uncovered criminal DGA activity long before the malware using the DGA technique was ever identified by the security community. This discovery was accomplished using patent-pending machine learning technology and years of passive DNS data collection and analysis. In addition, this case study describes how Damballa Labs, starting only with the identified DGA behavior, tied the DGA behavior to the criminal command-and-control (C&C) infrastructure and then to the malware, infection vectors and campaigns. The identified malware is a ZeuS version 3 variant that uses peer-to-peer as its primary C&C channel and only resorts to the DGAgenerated domains if it fails		This case study details how Damballa Labs uncovered criminal DGA activity long before the malware using the DGA technique was ever identified by the security community. This discovery was accomplished using patent-pending machine learning technology and years of passive DNS data collection and analysis. In addition, this case study describes how Damballa Labs, starting only with the identified DGA behavior, tied the DGA behavior to the criminal command-and-control (C&C) infrastructure and then to the malware, infection vectors and campaigns. The identified malware is a ZeuS version 3 variant that uses peer-to-peer as its primary C&C channel and only resorts to the DGAgenerated domains if it fails
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:32Z

1 revision imported

← Older revision	Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 10:14, 7 February 2015

2015-02-07T10:14:19Z

← Older revision		Revision as of 10:14, 7 February 2015
Line 4:		Line 4:
	\|ExploitKit=Sakura, Blackhole,		\|ExploitKit=Sakura, Blackhole,
	\|CCProtocol=P2P,		\|CCProtocol=P2P,
			\|Editor=Damballa
	\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)		\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)
	\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim		\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim

Eric.freyssinet at 10:09, 7 February 2015

2015-02-07T10:09:57Z

← Older revision		Revision as of 10:09, 7 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
			\|Image=Dambala_dga_zeus3.png
	\|Botnet=ZeuS, ZeuS - P2P+DGA,		\|Botnet=ZeuS, ZeuS - P2P+DGA,
	\|ExploitKit=Sakura, Blackhole,		\|ExploitKit=Sakura, Blackhole,

Eric.freyssinet at 10:02, 7 February 2015

2015-02-07T10:02:42Z

← Older revision		Revision as of 10:02, 7 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
			\|Botnet=ZeuS, ZeuS - P2P+DGA,
			\|ExploitKit=Sakura, Blackhole,
			\|CCProtocol=P2P,
	\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)		\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)
	\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim		\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim
			\|Abstract=In recent years, Domain Generation Algorithms (DGAs) have evolved from a proof-of-concept technique, capable of bypassing legacy static reputation systems (e.g. Domain Blacklists), into full-featured stealth modules embedded within an increasing number of advanced and evasive commercial crimeware toolkits today. DGAs are also referred to as a form of “domain fluxing.”
			This case study details how Damballa Labs uncovered criminal DGA activity long before the malware using the DGA technique was ever identified by the security community. This discovery was accomplished using patent-pending machine learning technology and years of passive DNS data collection and analysis. In addition, this case study describes how Damballa Labs, starting only with the identified DGA behavior, tied the DGA behavior to the criminal command-and-control (C&C) infrastructure and then to the malware, infection vectors and campaigns. The identified malware is a ZeuS version 3 variant that uses peer-to-peer as its primary C&C channel and only resorts to the DGAgenerated domains if it fails
	}}		}}

Eric.freyssinet at 10:00, 7 February 2015

2015-02-07T10:00:54Z

← Older revision		Revision as of 10:00, 7 February 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)		\|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)
			\|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim
	}}		}}

Eric.freyssinet: Created page with "{{Publication |Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf) }}"

2015-02-07T10:00:18Z

Created page with "{{Publication |Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf) }}"

@@ Line 1: / Line 1: @@
 {{Publication
 |Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)
 }}

Eric.freyssinet: Remplacement du texte — « Zeus » par « ZeuS »

2012-10-20T09:13:04Z

Remplacement du texte — « Zeus » par « ZeuS »

New page

{{Publication
|Image=dambala_dga_zeus3.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.damballa.com/downloads/r_pubs/RN_DGAs-and-Cyber-Criminals-A-Case-Study.pdf damballa.com (pdf)
|Author=Manos Antonakakis, Jeremy Demar, Christopher Elisan, John Jerrim,
|NomRevue=Research Note
|Date=ID.30.111.0224
|Editor=Damballa
|Year=2012
|ISBN=
|Page=
|Abstract=In recent years, Domain Generation Algorithms (DGAs) have evolved from a proof-of-concept technique, capable of bypassing legacy static reputation systems (e.g. Domain Blacklists), into full-featured stealth modules embedded within an increasing number of advanced and evasive commercial crimeware toolkits today. DGAs are also referred to as a form of “domain fluxing.”
This case study details how Damballa Labs uncovered criminal DGA activity long before the malware using the DGA technique was ever identified by the security community. This discovery was accomplished using patent-pending machine learning technology and years of passive DNS data collection and analysis. In addition, this case study describes how Damballa Labs, starting only with the identified DGA behavior, tied the DGA behavior to the criminal command-and-control (C&C) infrastructure and then to the malware, infection vectors and campaigns. The identified malware is a ZeuS version 3 variant that uses peer-to-peer as its primary C&C channel and only resorts to the DGAgenerated domains if it fails
|Botnet=ZeuS - P2P+DGA,
|Malware=ZeuS,
|ExploitKit=Sakura, Blackhole
|CCProtocol=P2P,
|Operation=,
|Keyword=DGA, Blackhole Exploit Kit, Sakura Exploit Kit,
}}