Lion Cipher Lab
Reverse a malware DGA and pre-empt its C2 (predict tomorrow's domains, then block them today)
- Threat Intel Analyst
- Advanced
- ~75 min
- Free · no account required
Why it matters
When malware needs orders, hard-coding one command-and-control (C2) domain is suicide: a defender blocks that single name and the malware goes deaf. So modern families use a Domain Generation Algorithm (DGA) -- a seeded routine that mints hundreds of throw-away pseudo-random domains a day. The attacker registers only a few; every infected host runs the identical algorithm and reconnects to whichever of the day's names resolves. MITRE ATT&CK catalogs this as Dynamic Resolution: Domain Generation Algorithms (T1568.002), and it is exactly why a reactive domain blocklist loses -- you are always…
What you'll learn
- what a Domain Generation Algorithm (DGA) is and why REVERSING it beats blocklisting when you want to get ahead of the C2 (MITRE ATT&CK T1568.002)
- reading and instrumenting an opaque, obfuscated 'captured' sample to recover its seed derivation, its pseudo-random generator (a linear congruential generator / LCG), its character mapping, its domain count/length, and its TLD-rotation scheme
- recognising a textbook weak PRNG by its constants (Numerical Recipes LCG: a=1664525, c=1013904223, modulus 2^32) and why a predictable seed makes the whole domain schedule pre-computable
- reimplementing the algorithm cleanly in your own Python and PROVING you understood it by reproducing the sample's exact domains byte-for-byte on a fixed date
- predicting future domains (next week's set) from the recovered algorithm -- the capability a blocklist can never give you
- turning prediction into DEFENCE: emitting a forward domain feed as a DNS Response Policy Zone (RPZ) that forges NXDOMAIN (block) or CNAMEs to a sinkhole (observe infected hosts) before the attacker registers a thing
- naming the hard limits: externally-seeded DGAs (exchange rates, trending topics) you cannot pre-compute, dictionary DGAs that defeat entropy detectors, and TLD rotation -- and knowing when to reverse vs when to just block
Steps in this lab
- Why REVERSE a DGA when you could just block it
- Meet the captured sample -- run it, see today's domains
- Reverse it: read the code and instrument the seed and the PRNG
- Reimplement it cleanly -- and prove you understood it by matching byte-for-byte
- Predict next week's domains -- the capability a blocklist can never give you
- Turn prediction into defence: emit a forward feed as a blocking RPZ
- When NOT to reverse, and the DGAs that beat pre-computation (opinion)