A DGA is a Domain Generating Algorithm. These algorithms provide malware with new domains when connecting back to a C2 server. Both the C2 server and the client need to implement the same DGA to keep in sync for constant communication at any given time.
DGAs are a necessary to avoid blacklisting which hinders the operation of the malware. Without a DGA a new version of malware would need to be deployed when the domain is discovered and blocked. A well written DGA is hard to determine and switches on a regular interval to avoid blacklisting keeping the C2 communication up and running. The result of a DGA is an AGD or algorithmically generated domain. The constant changing of domains is often referred to as Domain Fluxing.
Finding DGAs in malware is often the combination of reverse engineering and dynamic analysis. Reverse engineering will allow you to determine seed values and top level domains used to generate the domains. The goal is to reverse engineer the algorithm to predetermine domains for blacklisting. Alternately, you can run the malware and log network traffic reviewing the generated domains, and attempt to reverse engineer the algorithm which generated them.
In summary, DGAs provide malware authors a method to avoid detection and blacklisting of there C2 channel. Reverse engineering the DGA provides a method for defenders protect their networks from malicious activity. DGA authors will continue to think of new and clever ways of generating domains for C2 connectivity. Potential methods include seeding the algorithms based on trending topics on Twitter, stock market prices, or even the current value of bitcoin. The potential methods are only limited by one’s imagination.
distributedcompute.com 