Difference between revisions of "Domain generation algorithms (DGA) in stealthy malware"
m (1 revision imported) |
|||
Line 1: | Line 1: | ||
{{Publication | {{Publication | ||
| | |Botnet=Conficker, | ||
| | |Malware=, | ||
|CCProtocol=Conficker, | |||
|Operation=Conficker Working Group, | |||
|Year=2012 | |||
|Date=2012-03-05 | |||
|Editor=Damballa | |||
|Link=http://blog.damballa.com/?p=1504 blog.damballa.com | |||
|Author=Gunter Ollmann, | |||
|Abstract=Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server. | |||
The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere. | |||
|Document= | |Document= | ||
|Licence= | |Licence= | ||
|Video= | |Video= | ||
|NomRevue=The Day Before Zero | |NomRevue=The Day Before Zero | ||
|ISBN= | |ISBN= | ||
|Page= | |Page= | ||
|Keyword=DGA, | |||
|Keyword=DGA, | |||
}} | }} |
Revision as of 13:46, 31 July 2015
(Publication) Google search: [1]
Domain generation algorithms (DGA) in stealthy malware | |
---|---|
Botnet | Conficker |
Malware | |
Botnet/malware group | |
Exploit kits | |
Services | |
Feature | |
Distribution vector | |
Target | |
Origin | |
Campaign | |
Operation/Working group | Conficker Working Group |
Vulnerability | |
CCProtocol | Conficker |
Date | 2012 / 2012-03-05 |
Editor/Conference | Damballa |
Link | http://blog.damballa.com/?p=1504 blog.damballa.com (blog.damballa.com Archive copy) |
Author | Gunter Ollmann |
Type |
Abstract
“ Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.
The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR912, editor = {Damballa}, author = {Gunter Ollmann}, title = {Domain generation algorithms (DGA) in stealthy malware}, date = {05}, month = Mar, year = {2012}, howpublished = {\url{http://blog.damballa.com/?p=1504 blog.damballa.com}}, }