An unknown threat actor uses an interesting algorithm to generate sub-domains for its SUNBURST malware to pull down the next stage of execution on the target systems. The algorithm allows an attacker to avoid detection altogether or evade blocklists and IP blocking. As it is randomly generated, the malware attempts numerous random domains until it receives a proper response back and then proceeds with the next command from the C2 server. As the algorithm was seeded and able to be completely reverse-engineered from the malicious binary, researchers at ThreatExpert.com analyzed a sample of the Kraken malware.”]
Source: https://medium.com/swlh/what-is-a-domain-generation-algorithm-dga-44319aabcca7