SUNBURST Malware Analysis

Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA) has uncovered additional details about its encoding schemes and how it exfiltrates compromised hostnames. This includes identifying a quirk where long hostnames are split across multiple DNS queries, requiring a novel method of reassembly based on XORing GUIDs. The analysis also refines understanding of base32 encoding variants used by the malware and provides tools for matching fragmented DNS messages.