The DGA of DirCrypt

The DGA

DirCrypt is an inactive Ransomware that uses a Domain Generation Algorithm (DGA) for its callback call. Because I couldn`t find the DGA algorithm online, I decided to reverse engineer this sample from malwr.com. I list more samples that use the DGA in section Sample on malwr.com.

The DGA of DirCrypt uses a hardcoded seed located in the resource section of the executable. For the examined sample, the seed is labeled with the integer identifier 0x7D:

For my sample, the value of resource identifier 0x7D was 0xF2113C2A:

The malware passes the seed and the number of distinct domains it wants to generate to a subroutine I called spawn_6_callback_threads:

The subroutine creates six callback threads - all getting a pointer to the same structure with seed and number of domains. The routine will wait for all six threads to finish before it returns:

The callback routine callback_loop creates new domains with the following routine “the_dga”. The counter dga_nr_of_domains (initialized to 30) is decreased after a new domain is generated. The thread returns when a command-and-control callback is successful or the counter reaches zero. Here is the disassembly of the DGA:

UPX0:0040183B the_dga         proc near               
UPX0:0040183B
UPX0:0040183B seed            = dword ptr  4
UPX0:0040183B domain          = dword ptr  8
UPX0:0040183B
UPX0:0040183B                 push    ebx
UPX0:0040183C                 push    esi
UPX0:0040183D                 push    edi
UPX0:0040183E                 push    20
UPX0:00401840                 push    8
UPX0:00401842                 lea     eax, [esp+14h+seed]
UPX0:00401846                 push    eax
UPX0:00401847                 call    rand_int
UPX0:0040184C                 mov     ebx, [esp+0Ch+domain]
UPX0:00401850                 mov     edi, eax
UPX0:00401852                 xor     esi, esi
UPX0:00401854                 test    edi, edi
UPX0:00401856                 jbe     short loc_40186E
UPX0:00401858
UPX0:00401858 loc_401858:                            
UPX0:00401858                 push    'z'
UPX0:0040185A                 push    'a'
UPX0:0040185C                 lea     eax, [esp+14h+seed]
UPX0:00401860                 push    eax
UPX0:00401861                 call    rand_int
UPX0:00401866                 mov     [esi+ebx], al
UPX0:00401869                 inc     esi
UPX0:0040186A                 cmp     esi, edi
UPX0:0040186C                 jb      short loc_401858
UPX0:0040186E
UPX0:0040186E loc_40186E:                           
UPX0:0040186E                 push    offset a_com    ; ".com"
UPX0:00401873                 add     edi, ebx
UPX0:00401875                 push    edi
UPX0:00401876                 call    strcpy
UPX0:0040187B                 mov     eax, [esp+0Ch+seed]
UPX0:0040187F                 pop     edi
UPX0:00401880                 pop     esi
UPX0:00401881                 pop     ebx
UPX0:00401882                 retn    8
UPX0:00401882 the_dga         endp
UPX0:00401882

with rand_int being:

UPX0:00404E9E rand_int        proc near               
UPX0:00404E9E                                        
UPX0:00404E9E
UPX0:00404E9E seed            = dword ptr  4
UPX0:00404E9E lower           = dword ptr  8
UPX0:00404E9E upper           = dword ptr  0Ch
UPX0:00404E9E
UPX0:00404E9E                 mov     eax, [esp+upper]
UPX0:00404EA2                 sub     eax, [esp+lower]
UPX0:00404EA6                 push    eax             ; span
UPX0:00404EA7                 push    [esp+4+seed]
UPX0:00404EAB                 call    rand_mod
UPX0:00404EB0                 add     eax, [esp+lower]
UPX0:00404EB4                 retn    0Ch
UPX0:00404EB4 rand_int        endp

and rand_mod being a standard linear congruential generator:

UPX0:00404E6B rand_mod        proc near               
UPX0:00404E6B                                        
UPX0:00404E6B
UPX0:00404E6B seed            = dword ptr  4
UPX0:00404E6B span            = dword ptr  8
UPX0:00404E6B
UPX0:00404E6B                 mov     ecx, [esp+seed]
UPX0:00404E6F                 mov     eax, [ecx]
UPX0:00404E71                 xor     edx, edx
UPX0:00404E73                 push    esi
UPX0:00404E74                 mov     esi, 127773
UPX0:00404E79                 div     esi
UPX0:00404E7B                 pop     esi
UPX0:00404E7C                 imul    eax, 2836
UPX0:00404E82                 imul    edx, 16807
UPX0:00404E88                 sub     edx, eax
UPX0:00404E8A                 mov     eax, [esp+span]
UPX0:00404E8E                 mov     [ecx], edx
UPX0:00404E90                 lea     ecx, [eax+1]
UPX0:00404E93                 mov     eax, edx
UPX0:00404E95                 xor     edx, edx
UPX0:00404E97                 div     ecx
UPX0:00404E99                 mov     eax, edx
UPX0:00404E9B                 retn    8
UPX0:00404E9B rand_mod        endp

As mentioned above, all six threads access — inside a critical section — the same seed and dga_nr_of_domains. Therefore, at most 30 different domains are created. The following Python code generates the 30 domains of the DGA for a given seed:

import argparse

class RandInt:

    def __init__(self, seed): 
        self.seed = seed

    def rand_int_modulus(self, modulus):
        ix = self.seed                
        ix = 16807*(ix % 127773) - 2836*(ix / 127773) & 0xFFFFFFFF        
        self.seed = ix
        return ix % modulus 

def get_domains(seed, nr):
    r = RandInt(seed)
    for i in range(nr):
        domain_len = r.rand_int_modulus(12+1) + 8
        domain = ""
        for i in range(domain_len):
            char = chr(ord('a') + r.rand_int_modulus(25+1))
            domain += char
        domain += ".com"
        yield domain

if __name__=="__main__":
    parser = argparse.ArgumentParser(description="generate Dircrypt domains")
    parser.add_argument("seed", help="seed as hex")
    args = parser.parse_args()
    for domain in get_domains(int(args.seed, 16), 30):
        print(domain)

For example:

$ python dga.py f2113c2a
rauggyguyp.com
llullzza.com
mluztamhnngwgh.com
mycojenxktsmozzthdv.com
inbxvqkegoyapgv.com
furiararji.com
zrkdvzjhse.com
wyuhdsdttczd.com
hpaxgpkteomjaxywwelr.com
mydojltbqjnwailyyoa.com
wbgzpjfxlxlcvbth.com
pibqzedhzwt.com
vlbqryjd.com
nsxdczggybtkdukmyf.com
jarjvddjzqrmnepeqwd.com
plxeyaja.com
lfehajeex.com
swtjyuhuefvl.com
ftdkuoulfhfudds.com
eblgaosyeszzjkbhhdyh.com
afececrkycbeyqm.com
xnloppwhfamkcltuxkif.com
xjjcditjfkgkihfe.com
mblmvrla.com
vxlkofoazme.com
ktqyrmiyvnidd.com
jsntwyjcv.com
wvquldqwwsttp.com
pivzovznpssx.com
ggspyfmreouxnhqi.com

The following table summarizes the properties of the DGA:

Samples on malwr.com

I sifted through all samples on malwr.com where at least one of the virus scanners identified the sample as “DirCrypt”. I then brute forced the seed that leads to the observed domains. Because the callbacks run in six concurrent threads, the domains sometimes appear out of order. Also, some of the DirCrypt samples use an additional hardcoded domain: pdstriker.com, oktendentaries.com or jwuiygpnslht.com (this domain is generated by the DGA, just not with the hardcoded seed).

The following table lists the md5 hash of the sample (linked to the analysis on malwr.com), the submission date to malwr.com, the used seed, and any additional domains that are not covered by the DGA’s seed. The periodicity of the pseudo random number generator is 2³²/2 or half the number range; therefore, there are two seeds for each sequence of domains.

Most samples use the seed 52ce8a67 / d2ce8a66 (10 samples) and 72113c2b / f2113c2a (7 samples). The following table summarizes the seeds that I was able to identify, the first five generated domains, and the number of samples on malwr.com: