Of all the known malware families that use DGAs to communicate with their C2, only very few use DGAs that generate non-random-looking domain names. For example, Suppobox generates domain names by randomly selecting a few words from a hard-coded word-list and concatenating them together. Rovnix does the same but uses publicly accessible copies of the U.S. Constitution rather than a hard-coded list.

The goal of this is pretty clear: to circumvent the algorithms used by security software that detect random-looking domain names. So this has me wondering: why don't more DGAs do this? For a malware designer, what are the possible downsides to using this strategy?


2 Answers 2


Black hats have limited resources too, same as the white hats. Thus as long as a technique works good enough for a malware there is not much motivation to change it. Instead it is more effective to improve the parts of the malware which are more impacted by advancements of the white hats. But, if the current DGA algorithm too heavily impacts the functionality of the malware then the authors will probably move to different algorithms or use a different C+C communication architecture.


There are a few disadvantages to this technique:

Using words requires a dictionary. Dictionaries are big in volume and for a malware, obtaining them might be slow, noisy and hence dangerous (can be detected).

If they try to overcome this disadvantage they can use a small dictionary, but then the randomness of the generated algorithm is hurt and it is much easier to reverse engineer, identify and block this family of malware.

And another disadvantage are the very long domain names created by a number of words.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .