In Part 1 of this post I discussed what is decentralized domain name system and how Necurs is using it to avoid take-down. Then I got busy with other regular work and did not do further analysis. but recently I got some time and performed further analysis that I will share in this blog post.
Necurs is using decentralized top level domain ‘.bit’ that makes take-down of Necurs C&C theoretically impossible but it is not true in reality, it is still dependent on Namecoin DNS servers in its configuration file to resolve domain names. Whose records can be altered to point to sinkhole and can be used to take-down this botnet. And that Domain history can be analyzed to get a list of IP addresses pointed by that domain at any time. Those IP’s can be used for further analysis, and as evidence during take-down.
Don’t get excited just yet. Necurs has some more tricks up its Sleeve. Even if you manage to get a list of IP addresses pointed by some C&C domain of Necurs, it won’t lead you anywhere or may mislead you. As DNS server returned IP and contacted IP are different.
The IP with which Necurs tries to communicate, where did it came from, is it hard-coded?
Why it did not contact resolved IP?
This is another trick of Necurs to conceal its Command server infrastructure and make analysis difficult. Necurs does not directly contacts to IP address returned by DNS. It checks its configuration file and if option is specified, it modifies IP returned using Rotation and shift operations and contacts modified IP. Following code is used to manipulate returned IP to get real IP of C&C server:
Resolved IP modification
So for sinkholing or taking over DNS server requires knowledge of this feature. This is not the only method it uses to communicate to C&C, it also has DGA (Domain Generation Algorithm) as a fallback mechanism. DGA and Communication with server will be covered in subsequent blog when I get more time to work on Necurs 🙂
