Domain generation algorithms (DGA) in stealthy malware - Revision history

Eric.freyssinet at 03:24, 12 August 2015

2015-08-12T03:24:51Z

← Older revision		Revision as of 03:24, 12 August 2015
Line 2:		Line 2:
	\|Botnet=Conficker,		\|Botnet=Conficker,
	\|Malware=,		\|Malware=,
	~~\|CCProtocol=Conficker,~~
	\|Operation=Conficker working group,		\|Operation=Conficker working group,
	\|Year=2012		\|Year=2012

Eric.freyssinet at 11:47, 31 July 2015

2015-07-31T11:47:48Z

← Older revision		Revision as of 11:47, 31 July 2015
Line 3:		Line 3:
	\|Malware=,		\|Malware=,
	\|CCProtocol=Conficker,		\|CCProtocol=Conficker,
	\|Operation=Conficker ~~Working Group~~,		\|Operation=Conficker working group,
	\|Year=2012		\|Year=2012
	\|Date=2012-03-05		\|Date=2012-03-05

Eric.freyssinet at 11:46, 31 July 2015

2015-07-31T11:46:18Z

← Older revision		Revision as of 11:46, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|~~Image~~=		\|Botnet=Conficker,
	\|~~Legend~~=		\|Malware=,
			\|CCProtocol=Conficker,
			\|Operation=Conficker Working Group,
			\|Year=2012
			\|Date=2012-03-05
			\|Editor=Damballa
			\|Link=http://blog.damballa.com/?p=1504 blog.damballa.com
			\|Author=Gunter Ollmann,
			\|Abstract=Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.

			The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.
	\|Document=		\|Document=
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	~~\|Link=http://blog.damballa.com/?p=1504 blog.damballa.com~~
	~~\|Author=Gunter Ollmann,~~
	\|NomRevue=The Day Before Zero		\|NomRevue=The Day Before Zero
	~~\|Date=March 5 2012~~
	~~\|Editor=Damballa~~
	~~\|Year=2012~~
	\|ISBN=		\|ISBN=
	\|Page=		\|Page=
	\|Abstract=Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.		\|Keyword=DGA,

	The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.
	~~\|Botnet=Conficker,~~
	~~\|Malware=,~~
	~~\|CCProtocol=Conficker,~~
	~~\|Operation=The Conficker Working Group,~~
	\|Keyword=DGA,
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:31Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.damballa.com/?p=1504 blog.damballa.com
|Author=Gunter Ollmann,
|NomRevue=The Day Before Zero
|Date=March 5 2012
|Editor=Damballa
|Year=2012
|ISBN=
|Page=
|Abstract=Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.

The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.
|Botnet=Conficker,
|Malware=,
|CCProtocol=Conficker,
|Operation=The Conficker Working Group,
|Keyword=DGA,
}}