4 ms·
> or even better, just generate a random new domain every single time. I'm no expert, but I do recall reading in one of the WC write-ups that there is known ma
by ineptech 9y ago
> or even better, just generate a random new domain every single time.
I'm no expert, but I do recall reading in one of the WC write-ups that there is known malware that does this.
- clwg 9y agoIt's called a DGA or domain generation algorithm, I believe Conficker was one of the first botnet's to use this approach about 10 years ago, it's pretty standard trade craft nowadays. https://en.wikipedia.org/wiki/Domain_generation_algorithm https://en.wikipedia.org/wiki/Domain_generation_algorithm
- ehsankia 9y agoWell this is slightly different. DGA seems to actually use it as a rendez-vous host, whereas in this case, it literally is a dummy domain that they didn't even bother registering, with the only purpose of checking if they were in a VM. In which case, generating any long hash domain would most likely not be registered and would do the job.