Bedep’s DGA: Trading Foreign Exchange for Malware Domains
As initially researched by Trend Micro [1] [2], Zscaler [1] [2], Cyphort, and Malware don’t need Coffee, the Bedep malware family focuses on ad / click fraud and the downloading of additional malware. ASERT’s first sample dates from September 22, 2014, which is in line with when Trend Micro started seeing it in their telemetry. In early 2015, the family got some more attention when it was being observed as the malware payload for some instances of the Angler exploit kit, leveraging the Adobe Flash Player exploit (CVE-2015-0311) which at the time was a 0day. It was also observed that this newer version was using a domain generation algorithm (DGA) to generate its command and control (C2) domain names.
This post provides some additional notes on the DGA including a proof of concept Python implementation, a look at the two most recent sets of DGA generated domains, and concludes with some sinkhole data.
Samples
The following Bedep samples were used for this research:
- MD5 e5e72baff4fab6ea6a1fcac467dc4351
- MD5 1b84a502034f7422e40944b1a3d71f29
The former was originally sourced from KernelMode.
Algorithm
I’ve posted a proof of concept (read: works for me) Python implementation of the DGA to ASERT’s Github.
At the time of Continue reading
Another partnership between the two giants, this time targeting telco-managed security.
Juniper, DevOps, and RSA itself — it's a packed week at the annual security confab.