Blogs›Cloudflare›SUNBURST Malware Analysis
Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA) has uncovered additional details about its encoding schemes and how it exfiltrates compromised hostnames. This includes identifying a quirk where long hostnames are split across multiple DNS queries, requiring a novel method of reassembly based on XORing GUIDs. The analysis also refines understanding of base32 encoding variants used by the malware and provides tools for matching fragmented DNS messages.
12/18/2020
This post details Cloudflare's analysis of the SUNBURST malware's DGA, focusing on the encoding of GUIDs and hostnames. It identifies a critical quirk where hostnames are split across multiple DNS queries, and proposes a method for reassembling these fragments by XORing the GUIDs of paired messages. The post also refines the understanding of the base32 encoding variants used and provides Python code for matching these fragmented messages.