When analyzing malware we can gather a lot of information just by identifying the IP addresses and domains the malware software uses. Most malware software programs use DNS addresses to find the resources online. The domain resolution system is a system where we provide a hostname which is automatically converted into the right IP address, so we don’t need to remember the IP numbers themselves. But when programming malware programs, we don’t need to remember any IP numbers, since they are embedded into the malware itself. So why is using the DNS names still beneficial for malware programmers?
There is one single very important reason: it’s because the DNS name can easily be changed to point to some other IP address. So if the first server is taken down by the government or law enforcement, the IP address can quickly be changed to point to a new server location. This way, the malware can still function properly even though the initial server was taken down.
2. Suspicious Domains
Specific domains are suspicious if they apply the following categories, summarized from [1]:
– The domain is very similar to a real domain. – The domain consists of random characters. – The domain was registered or updates just a few moments before discovering it. – The domain expires within a few weeks or months. – There is no useful information about the domain’s registrant. – When searching for a domain in search engine, only suspicious results come back. – The domain has been reported as hosting malicious content.
2.1. WHOIS
The first thing we need to do when researching a domain is gather information with WHOIS, which queries databases that store information about registered users of Internet resources, like domain names, IP address ranges, and autonomous systems. It then returns the information in a human readable form. When executing WHOIS against a database, we can get the information about the domain’s registrant, its contact details, when the domain was registered, when the domain will expire, etc. When analyzing suspicious domains, the information fields in those results will often be blank or won’t include useful information.
But there is one problem with the WHOIS domain search. The problem is that simply running the WHOIS against a domain name can reveal only the basic information, not all of the available information. This is because there are many domain registrars and each of them keeps its own WHOIS database, which doesn’t include the information about other domains registered by competing registrars. Because of these we often need to query different registrars to get all the available information.
Let’s try to determine the information about the domain name infosecresources.com. If we use the WHOIS tool, we’ll find out the information presented below:
[plain] # whois infosecresources.com
Domain Name: INFOSECRESOURCES.COM Registrar: GODADDY.COM, LLC Whois Server: whois.godaddy.com Referral URL: http://registrar.godaddy.com Name Server: NS1189.DIZINC.COM Name Server: NS1190.DIZINC.COM Status: clientDeleteProhibited Status: clientRenewProhibited Status: clientTransferProhibited Status: clientUpdateProhibited Updated Date: 16-jul-2012 Creation Date: 31-aug-2008 Expiration Date: 31-aug-2014
Registered through: GoDaddy.com, LLC (http://www.godaddy.com) Domain Name: INFOSECRESOURCES.COM Created on: 31-Aug-08 Expires on: 31-Aug-14 Last Updated on: 16-Jul-12
Registrant: Domains By Proxy, LLC DomainsByProxy.com 14747 N Northsight Blvd Suite 111, PMB 309 Scottsdale, Arizona 85260 United States
Administrative Contact: Private, Registration INFOSECRESOURCES.COM@domainsbyproxy.com Domains By Proxy, LLC DomainsByProxy.com 14747 N Northsight Blvd Suite 111, PMB 309 Scottsdale, Arizona 85260 United States (480) 624-2599 Fax — (480) 624-2598
Technical Contact: Private, Registration INFOSECRESOURCES.COM@domainsbyproxy.com Domains By Proxy, LLC DomainsByProxy.com 14747 N Northsight Blvd Suite 111, PMB 309 Scottsdale, Arizona 85260 United States (480) 624-2599 Fax — (480) 624-2598
Domain servers in listed order: NS1189.DIZINC.COM NS1190.DIZINC.COM [/plain]
The output shows that the domain was registered through a company called GoDaddy (the registrar) on 31.8.2008. The domain expires on 31.8.2014 and was last updated on 16.8.2012 (which is about a month ago). There is also contact information for the administrative and technical staff, which are the same.
The registrars usually contain information not only about the domains registered with the registrar itself but with other registrars as well. But sometimes this is not the case and we must ask a different registrar for additional information if some information isn’t available. In such cases we would have to ask different WHOIS servers for additional information. To do that we would need to use the -h option to specify which WHOIS server to ask for information about the domain.
The WHOIS usually returns the following attributes about a domain:
– inetnum: the IP range the address falls under.
– route: The address prefix to be routed.
– descr: A short description related to the domain, including the organization responsible for the route object.
– origin: The AS number used to route the address prefix. The AS number must be registered in the APNIC WHOIS database before it can be referenced in the route object.
– mnt-by: Lists a registered mntner used to authorize and authenticate changes to this object. A mntner object is a database object used to authorize updates to the APNIC database. If the database is protected by the mntner user, then only he or she can change the details.
– changed: The email address of who last updated the database object and the date it occurred. This address shouldn’t be used as a contact address.
– source: The database where the object is registered.
Optional attributes are:
– country: Two letter code of the country where the admin-c is located.
– holes: Lists address prefixes that are not reachable through the route.
– member of: Identifies a route-set object of which you with this route are a member.
– inject: Specifies which routers perform the aggregation and when the routers should perform the aggregation.
– aggr-mtd: Specifies how the route aggregate is generated.
– aggr-bndry: TA set of AS which form the aggregation boundary.
– export-comps: The RPSL filter that matches the more specific routes that need to be exported outside the aggregation boundary.
– components: The component routes used to form the aggregate.
– remarks: General remarks related to the role object.
– notify: The email address to which notifications of changes to this object should be sent.
– mnt-lower: If the mnt-routes attribute is included, the registered mntnet object specified in the mnt-lower attribute is used to control the creation of more specific route objects.
– mnt-routes: The identifier of a registered mntner object used to control the creation of route objects more specific than this route object.
We can search the WHOIS database by the use of primary keys, lookup key and inverse keys:
– Primary Key: distinguishes an object from all other objects in the database. Primary keys are: route, origin.
– Lookup Key: Attribute can be queried in the database to return the object. Lookup key is: route.
– Inverse Key: Attribute can be used when performing an inverse query using the -i flag. Inverse keys are: origin, member-of, notify, mnt-lower, mnt-routes, mnt-by. This allows us to search for results using various attributes, and not just IP address. For example, the query below will return the IP range of a specific
