What Is a Domain Generation Algorithm (DGA)?
By: Jacob Latonis
Tags: Cryptography, Cybersecurity, Russia, Cyberattack, News

If you have been following the news in the world of Cybersecurity lately, you’ve probably seen, heard, or read a thing or two about SolarWinds, FireEye, or Microsoft amongst many others being targeted by an unknown threat actor. While not the first, this threat actor uses an interesting algorithm to generate sub-domains for its SUNBURST malware to pull down the next stage of execution on the target systems.

When an attacker implements a DGA, the result allows an attacker to avoid detection altogether or evade blocklists and IP blocking. Attackers can quickly switch domains, evade security practices and blocks, and makes it difficult to initiate domain seizures and takedowns, such as seen with Microsoft and TrickBot.¹ The DGAs are successful because the program attempts to beacon home for all of the randomly generated addresses, but the malware only needs to connect to one of them to be successful, meaning the attackers can quickly spin up domains and control panels.

A history of DGAs and their uses is pretty slim, but it is an interesting history, to say the least. The first malware family (known at least) to implement a domain generation algorithm is the Kraken family. In 2008, researchers discovered the Kraken malware evolved to include pseudo-random domains that the malware generated itself. ThreatExpert.com analyzed a sample of the Kraken malware, and it is available on its blog².

Domain Generation Algorithm from the Kraken Malware (ThreatExpert)

Walking through the assembly code shows that the domain is generated from a seeded algorithm which generates a complete URL with a random string comprised of vowels and consonants that almost mimic English grammar and word structure, due to the shift of characters. Once the random “word” is generated, it is then appended with a domain suffix and attempted to connect to the command and control (C2) server to receive its next set of instructions from the control panel. As the algorithm was seeded and able to be completely reverse-engineered from the malicious binary, researchers at ThreatExpert created a list of all possible domains that could be generated by the algorithm.

Examples of this DGA include:

zaljljiebm[.]yi[.]org

xdpdrrzrtmy[.]dynserv[.]com

vnlxpriemei[.]mooo[.]ctom

tqorwrzimvsz[.]dyndns[.]org

saklurivevc[.]yi[.]org

qdofarzixnna[.]mooo[.]com

gnkhyrimpn[.]com

and many more.

Another example of malware implementing DGA methods in its code is the Zeus malware family³. Zeus is a botnet that targets banks and financial institutions. With the botnet being spread via emails and infected websites, the botnet can operate virtually undetectable to the common user and lack of an EDR or proper anti-virus or malware solution. The reason it is able to remain virtually undetectable is due, in part, to the DGA scheme that is implemented in the malware. As it is randomly generated, the malware attempts numerous random domains until it receives a proper response back and then proceeds with the next stage or commands from the C2 server. The actual function that the Zeus malware, specifically Zeus.V3, uses is comprised of the following: one of the six TLDs of .biz, .com, .net, .org, .ru, or .info and a 33–45 character pseudo-random string of alphanumeric characters placed before the TLD that was selected⁴. Similar to Microsoft, the FBI attempted to take down C2 servers and domains used with the Zeus malware; however, due to the servers addresses being randomly generated, the attackers can rely solely on the .ru TLD domain until they can generate more of the other 5 TLDs used in the past, assuming the FBI is able to seize all of the others. Then, it is back to step 1 for the FBI and attempting to stop the malware and its operations.

In more recent uses, the threat actor behind the supply chain compromise of SolarWind’s Orion platform created quite the DGA algorithm for C2 communications. An example of the SUNBURST DGA algorithm produces a domain such as:

04r0rndp6aom5fq5g6p1[.]appsync-api[.]us-west-2[.]avsvmcloud[.]com

In a recent discovery, the RedDrip team was able to begin to decode the domain generation algorithm used in the SolarWinds compromise. It is a little more complicated than the Kraken malware’s DGA. The domain generation employs two different methods for generating the domains.

The first method consists of a few main parts. The main parts are the unique GUID, which is a hash of the hostname and MAC address of the current host, and a payload in the malware that is a simple alphabet substitution and shift encoding of the hostname that also employs the use of a substitution table (“rq3gsalt6u1iyfzop572d49bnx8cvmkewhj”) that shifts the characters 4 from wherever the given character is found on the table. This substitution pattern is similar to a basic cryptography technique called a “Caesar Cipher”⁵, except it also employs a substitution table as well as the shift.

The second method consists of the unique GUID mentioned before and a Base64 encoding scheme with another hardcoded key for its custom alphabet (“ph2eifo3n5utg1j8d94qrvbmk0sal76c”). The malware decides which scheme to use based on the victim hosts’ domain name, and whether it contains lower-case letters (first method) or upper-case letters (second method)⁶.

As seen in the algorithms exampled in this post, there are quite a few ways to generate a domain that can be used for C2 communications and much more. DGA can be simply implemented such as the Kraken malware or much more complex such as the SUNBURST malware which was recently discovered. There is no limit to what the algorithm can generate, given the uniqueness and speed at which these algorithms can generate domain names and URLs.