NTRG_ElasticBotnetReport_06102015

2.4.1.4 CSubTask.taskType = 0x83: RANDOM SUBDOMAIN LOOKUP FLOOD
This type of transmission targets the DNS protocol. CThreadAttack::PktAtk begins by initializing a
set of 16 random subdomain names that have the same base domain name as the domain specified
by CSubTask.strActorRemarks. Each of the random subdomain strings consists of a sequence of
the letter “a” of different lengths. The length of each random subdomain string is equal to its index.
For example, the first string is “a”, the second string is “aa”, the third is “aaa”, and so on. Each string
is constructed to conform to the DNS query notion where the first byte for each substring is the
number of characters that follows. As an example, the first random subdomain string (if the target
domain is “novetta.com”) would consist of the following bytes:
0x01, ‘a’, 0x07, ‘n’, ‘o’, ‘v’, ‘e’, ‘t’, ‘t’, ‘a’, 0x03, ‘c’, ‘o’, ‘m’
And the second random subdomain string would be, for the same example:
0x02, ‘a’, ‘a’, 0x07, ‘n’, ‘o’, ‘v’, ‘e’, ‘t’, ‘t’, ‘a’, 0x03, ‘c’, ‘o’, ‘m’
Each time that the CThreadAttack::PktAtk issues a CSubTask.taskType = 0x83 attack,
CThreadAttack::PktAtk will mutate a single randomly generated subdomain name by a single
character by calling CThreadAttack::DomainRandEx. CThreadAttack::DomainRandEx will randomly
select a character within the outer level subdomain and replace it with a letter or number in the string
“abcdefghijklmnopqrstuvwxyz0123456789”.
CThreadAttack::PktAtk will manually construct a DNS query for an A record for the randomly
generated domain name and send the request, via UDP port 53, to the server specified by
CSubTask.dwTargetIP. After transmitting the request, CThreadAttack::PktAtk will immediately
generate another domain name (using the method described above) and repeat the process of
generating and issuing a DNS query ad nauseum. Given a large enough Elknot botnet, this could
potentially cripple even well resourced DNS servers.
THE ELASTIC BOTNET REPORT
20