Subsequent Model of the Bazar Loader DGA

Final week, a brand new model of the Bazar Loader Area Era Algorithm (DGA) appeared. I already analyzed two earlier variations, so I’m protecting this publish quick.

The DGA nonetheless makes use of the eponymous .bazar high stage area, however the second stage domains are shorter with 8 characters as an alternative of 12 for the earlier variations:

liybelac.bazar
izryudew.bazar
biymudqe.bazar
fuicibem.bazar
biykonem.bazar
aqtielew.bazar
yptaonem.bazar
exyxtoca.bazar
iqfisoew.bazar
aguponew.bazar
exogelqe.bazar
exybonyw.bazar
etymonac.bazar

I analysed the next pattern with out a lot obfuscation. There are various different samples which have further reverse engineering counter measures akin to junk code, however a fast comparability revealed no useful variations.

MD5

c6502d4dd27a434167686bfa4d183e89

SHA1

bddbceefe4185693ef9015d0a535eb7e034b9ec3

SHA256

35683ac5bbcc63eb33d552878d02ff44582161d1ea1ff969b14ea326083ea780

Measurement

336 KB (344576 Bytes)

Compile Timestamp

2020-12-10 13:05:18 UTC

Hyperlinks

MalwareBazaar, Malpedia, Cape, VirusTotal

Filenames

1ld.3.v1.exe, 35683ac5bbcc63eb33d552878d02ff44582161d1ea1ff969b14ea326083ea780 (VirusTotal)

Detections

Virustotal: 8/72 as of 2020-12-11 02:58:32 – Win64/Bazar.Y (ESET-NOD32), Backdoor.Win32.Bazdor.co (Kaspersky), Trojan.Win64.BAZALOADER.SMYAAJ-A (TrendMicro), Trojan.Win64.BAZALOADER.SMYAAJ-A (TrendMicro-HouseCall)

Unpacking the pattern results in this:

MD5

e44cfd6ecc1ea0015c28a75964d19799

SHA1

cb294c79b5d48840382a06c4021bc2772fdbcf63

SHA256

52e72513fe2a38707aa63fbc52dabd7c7d2c5809ed7e27f384315375426f57bf

Measurement

96 KB (98816 Bytes)

Compile Timestamp

2020-12-09 10:16:56 UTC

Hyperlinks

MalwareBazaar, Malpedia, Cape, VirusTotal

Filenames

content material.28641.20903.13470.9122.7127 (VirusTotal)

Detections

Virustotal: 4/75 as of 2020-12-15 21:30:37

Reverse Engineering

Aside from the frequent dynamic loading of Home windows API capabilities and encrypted strings, Bazar Loader depends on arithmetic substitution through identities to obfuscate the code. The next relationship is especially usually used:

$$ a oplus b = (sim a cdot b) + (a cdot sim b) $$

The identical obfuscation can also be utilized by Zloader. It makes the code very laborious to learn. Here’s a small snippet from the DGA:

Hex Ray’s decompiler additionally produces actually messy code as a result of the arithmetic identities will not be simplified:

The DGA makes use of the present month and yr because the seed. The seed is saved as a string, and its 4 ASCII characters are the idea for choosing 4 character pairs. These 4 pairs are joined to kind the 8 second stage characters.

The listing of character pairs is generated by calculating the cartesian product of the consonants “bcdfghklmnpqrstvwxz” and vowels (with y) “aeiouy”. The product is calculated each methods, resulting in 19·6·2 character pairs. These pairs are then concatenated into a big string of 456 characters by utilizing a hardcoded sequence of random numbers:

qeewcaacywemomedekwyuhidontoibeludsocuexvuuftyliaqydhuizuctuiqow
agypetehfubitiaziceblaogolryykosuptaymodisahfiybyxcoleafkudarapu
qoawyluxqagenanyoxcygyqugiutlyvegahepovyigqyqibaeqynyfkiobpeepby
xaciyvusocaripfyoftesaysozureginalifkazaadytwuubzuvoothymivazyyz
hoevmeburedeviihiravygkemywaerdonoyryqloammoseweesuvfopiriboikuz
orruzemuulimyhceukoqiwfexuefgoycwiokitnuneroxepyanbekyixxiuqsias 

The string is then encrypted utilizing a random xor key of the identical size.

Aside from the date-based seed, the DGA additionally makes use of a normal linear congruential generator (LCG) to choose the 4 character pairs. The LCG is seeded with the present processor tick depend and thus unpredictable. For the primary two character pairs, the random quantity is taken mod 19, and for the remaining two pairs mod 6. These numbers correspond to the size of the consonants and vowels array, however make no sense on this context. As a result of the random numbers are unpredictable, any mixture of the 19·19·6·6 = 12996 character pairs may very well be picked. Bazar Loader generates 10’000 domains per run, however doesn’t assure they’re distinctive. On common, 6975 distinctive domains are anticipated:

$$ mathbb{E} = 12996left( 1 – left(frac{12996-1}{12966}proper)^{10000} proper) = 6975 $$

Even with the quick ready time between resolving domains, the malware might want to run a very long time to get by the listing of domains.

Reimplementation in Python

The next Python code reveals how the domains are generated:

from itertools import product
from datetime import datetime
import argparse
from collections import namedtuple

Param = namedtuple('Param', 'mul mod idx')
pool = (
    "qeewcaacywemomedekwyuhidontoibeludsocuexvuuftyliaqydhuizuctuiqow"
    "agypetehfubitiaziceblaogolryykosuptaymodisahfiybyxcoleafkudarapu"
    "qoawyluxqagenanyoxcygyqugiutlyvegahepovyigqyqibaeqynyfkiobpeepby"
    "xaciyvusocaripfyoftesaysozureginalifkazaadytwuubzuvoothymivazyyz"
    "hoevmeburedeviihiravygkemywaerdonoyryqloammoseweesuvfopiriboikuz"
    "orruzemuulimyhceukoqiwfexuefgoycwiokitnuneroxepyanbekyixxiuqsias"
    "xoapaxmaohezwoildifaluzihipanizoecxyopguakdudyovhaumunuwsusyenko"
    "atugabiv"
)


def dga(date):
    seed = date.strftime("%mpercentY")
    params = [
        Param(19, 19, 0),
        Param(19, 19, 1),
        Param(6, 6, 4),
        Param(6, 6, 5)
    ]
    ranges = []
    for p in params:
        s = int(seed[p.idx])
        decrease = p.mul*s
        higher = decrease + p.mod
        ranges.append(listing(vary(decrease, higher)))

    for indices in product(*ranges):
        area = ""
        for index in indices:
            area += pool[index*2:index*2 + 2]
        area += ".bazar"
        yield area


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument(
        "-d", "--date", assist="date used for seeding, e.g., 2020-06-28",
        default=datetime.now().strftime('%Y-%m-%d'))
    args = parser.parse_args()
    d = datetime.strptime(args.date, "%Y-%m-%d")
    for area in dga(d):
        print(area)

Listed below are all of the domains for December 2020, January 2021, February 2021, and March 2021.

Traits

The next desk summarizes the properties of the brand new Bazar Loader DGA.