Difference between revisions of "Domain generation algorithms (DGA) in stealthy malware"
Line 3: | Line 3: | ||
|Malware=, | |Malware=, | ||
|CCProtocol=Conficker, | |CCProtocol=Conficker, | ||
|Operation=Conficker | |Operation=Conficker working group, | ||
|Year=2012 | |Year=2012 | ||
|Date=2012-03-05 | |Date=2012-03-05 |
Revision as of 13:47, 31 July 2015
(Publication) Google search: [1]
Domain generation algorithms (DGA) in stealthy malware | |
---|---|
Botnet | Conficker |
Malware | |
Botnet/malware group | |
Exploit kits | |
Services | |
Feature | |
Distribution vector | |
Target | |
Origin | |
Campaign | |
Operation/Working group | Conficker working group |
Vulnerability | |
CCProtocol | Conficker |
Date | 2012 / 2012-03-05 |
Editor/Conference | Damballa |
Link | http://blog.damballa.com/?p=1504 blog.damballa.com (blog.damballa.com Archive copy) |
Author | Gunter Ollmann |
Type |
Abstract
“ Do you remember all the fuss about Conficker many moons ago and its odd method of locating C&C servers? Instead of relying upon a static list of preconfigured domain names that corresponded to the location of the badguys C&C servers, it used an algorithm to calculate candidate domain names – and then tried reaching out to a handful of the candidates in a vein attempt to locate an active C&C server.
The authors behind the Conficker variants experimented with a number of algorithms but, at the end of the day, they failed to construct a cohesive botnet. Despite that “minor flaw”, Conficker infected devices still account for a sizable fraction of known malware infections around the work – years after the threat was studied to death and detection/protection/cleanup solutions are available everywhere.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR912, editor = {Damballa}, author = {Gunter Ollmann}, title = {Domain generation algorithms (DGA) in stealthy malware}, date = {05}, month = Mar, year = {2012}, howpublished = {\url{http://blog.damballa.com/?p=1504 blog.damballa.com}}, }