simda

The DGA of Simda/Shiz

Disclaimer

These are just unpolished notes. The content likely lacks clarity and structure; and the results might not be adequately verified and/or incomplete.

Aliases

The malware in this blog post is known as Simda and iBank

Table of Contents

DGArchive

The DGA in this blog post has been implemented by the DGArchive project.

Malpedia

For more information about the malware in this blog post see the Malpedia entry on Simda.

Only when I had already finished the DGA of Simda/Shiz, I noticed that DGArchive and Abuse.ch analysed Simda’s DGA before me. All this entry contributes are two additional seeds.

The DGA

The DGA is pretty simple:

length = 7
tld = "com"
key = "1676d5775e05c50b46baa5579d4fc7"
base = 0x45AE94B2

consonants = "qwrtpsdfghjklzxcvbnmv"
vowels = "eyuioa"

step = 0
for m in key:
    step += ord(m)

for nr in range(1000):
    domain = ""
    base += step

    for i in range(length):
        index = int(base/(3+2*i))
        if i % 2 == 0:
            char = consonants[index % 20]
        else:
            char = vowels[index % 6]
        domain += char

    domain += "." + tld
    print(domain)

The length, top level domain, and the key vary from sample to sample. For the domain generation, only the sum of the key’s character matter, the key itself is irrelevant.

The Seeds

I found five different sets of seeds + one on virustracker:

setbasedomain lengthtldkeykey sumfirst 10 domains
145AE94B27com1676d5775e05c50b46baa5579d4fc72052gatyfus.com, lyvyxor.com, vojyqem.com, qetyfuv.com, puvyxil.com, gahyqah.com, lyryfyd.com, vocyzit.com, qegyqaq.com, purydyv.com
245AE94B25eu1670cf21500911e1758e2b0dd5b41824lykef.eu, qekol.eu, galin.eu, volup.eu, puzej.eu, lyxav.eu, qexor.eu, gacuf.eu, vocyz.eu, puvem.eu
345AE94B27info167cd47c0a09c9036d6097b754ab2e732146qebevil.info, citokec.info, jejudin.info, divywew.info, wetavop.info, vojokyf.info, lyvudoj.info, fotyryz.info, ryhabov.info, novolym.info
445AE94B27info?2038puwedyp.info, tulokuq.info, rypubuv.info, rycyril.info, wedafog.info, qebolap.info, qeguneq.info, mamytec.info, najagyk.info, noroxuf.info
545AE94B211eu1670cf215403c56d8859a0636ffc741952cihunemyror.eu, digivehusyd.eu, vofozymufok.eu, fodakyhijyv.eu, nopegymozow.eu, gatedyhavyd.eu, marytymenok.eu, jewuqyjywyv.eu, qeqinuqypoq.eu, kemocujufys.eu
545AE94B211eu1670cf215403c56d8859a0636ffc741952cihunemyror.eu, digivehusyd.eu, vofozymufok.eu, fodakyhijyv.eu, nopegymozow.eu, gatedyhavyd.eu, marytymenok.eu, jewuqyjywyv.eu, qeqinuqypoq.eu, kemocujufys.eu
645AE94B27info?2182lyromex.info, maxenem.info, dosuves.info, xubaxej.info, wehyzav.info, gaqokaw.info, vilehaf.info, tupigal.info, jevadan.info, nofupat.info

I have not had access to a sample for the fourth and sixth seed, but found the key sum to be 2038 by brute forcing. Here is a Python script of the DGA that contains these five seeds.

Samples on Malwr.com

The following table lists samples from malwr.com that use the DGA of Simda/Shiz:

md5analysis datesetKasperskyMicrosoftSymantec
9c5e9e1a049ec198abf461f92758d8b514 May. 20131Shiz.rajInjector.gen!BQ©
ecbdcf103052f1537798e5b27e1f253826 Aug. 20133Shiz.afaiSimda.gen!BWS.Reputation.1
d0acd37e9075990d0f1289db350c258d08 Nov. 20131©Simda.AFShiz!gen
c4d1a029de33208a56eba8f5fe8b6eb203 Feb. 20145(g)©©
1fde0e0a2b16fcb4c483ec7ed853175619 Mar. 20145(g)Injector.THShiz!gen
1fde0e0a2b16fcb4c483ec7ed853175619 Mar. 2014R5(g)Injector.THShiz!gen
fdcab35a4d38deb9d41a3c1f12075d2223 Mar. 20145Shiz.aklrInjector.TH©
7070ac6706e345e75103054a4f30ff4d26 Mar. 20145???
71ca5168b13f6657f79c9d43ed44837230 Mar. 20143(g)Simda.gen!F
0972ebba0a8f21f930c7e2f27be9664629 May. 20141(g)Simda.DWS.Reputation.1
39f2998a165cb2f5986bf288e715349030 May. 20141Shiz.tiqSimdaWS.Reputation.1
03b7288ba9876ad4e80074ab95cb889f22 Jun. 20145(g)SimdaShiz!gen2
301eb56db2e5e601453da34698f9db1b25 Jun. 20145(g)SimdaWS.Reputation.1
0537c9f2dc45b10be4c276600f7af03526 Jun. 20141Shiz.rajSimda.GMalcol
02f6cb7a90169b8569133a75a74e9ba027 Jun. 20145(g)©(g)
10708d7d77ab864f1d38fe1b6161422d29 Jun. 20145(g)Simda(g).2
11b54c5d8531c0705d30a87f2b42a20f29 Jun. 20144Shiz.cxguSimdaWS.Reputation.1
12a92f800239af5e715842d6fcf7c82c30 Jun. 20145(g)Obfuscator.WY(g).2
14ce26edf8ccf4b5dc6e8170ecc04a8201 Jul. 20145(g)Simda.AA©
174b8b6048cc18e069a633786ead5cc301 Jul. 20145(g)SimdaFakeAV
196e7f6c572a2ea7afcc322530f8f97001 Jul. 20143(g)Simda.gen!FWS.Reputation.1
25c9bb91088b6062ac5ce8d214cd93a503 Jul. 20145(g)Obfuscator.ZVShiz!gen2
34920722bdfe2ce5cff7e2f69293966605 Jul. 20141Shiz.rajSimdaWS.Reputation.1
564dff857b3c0c3ef304df86d69dbe4d13 Jul. 20145(g)Simda.X(g)
575401b07ccec2f84ff6e46d26a84dc514 Jul. 20145(g)©©
7b9d6e2d8a0a0b20d493ea2f37de260d18 Jul. 20141(g)Simda.PShiz!gen
7974fb86000385219d4b9cd63bcb0d2f20 Jul. 20145(g)Obfuscator.ZVShiz!gen2
7df9185319e4877fc0322bdf56af89bc20 Jul. 20145?SimdaShiz!gen2
809652095b88a2fa0ea4dd89760599c121 Jul. 20142(g)Simda.AFShiz!gen
83f2ad344ca7225cb675c03d0c66a0b621 Jul. 20145(g)SimdaWS.Reputation.1
8b7000002d47146d7d7e7ba2c5b3d12022 Jul. 20145(g)SimdaShiz
9977d2b1b279112cc1024858802b3ab823 Jul. 20145(g)Simda.U(g)
ad71cd5a05db9473c5580eb070963bf902 Mar. 20151(g)Simda.AFShiz!gen

(g): generic, ?: not scanned, ©: clean