Five practical examples that any analyst can use to uncover malicious infrastructure with Passive DNS

Introduction

Passive DNS is a powerful tool that enables analysts to discover infrastructure through patterns contained in DNS records. Since DNS includes information on IP addresses (via A records) and Name Servers, we can use these to look for commonalities where similar records have been re-used and shared.

You’d be surprised just how much you can find with Passive DNS, so today, we’re exploring five practical examples that any analyst can use to uncover malicious infrastructure with Passive DNS.

What Is Passive DNS?

Passive DNS is effectively a database of DNS “snapshots” over time. This allows an analyst to observe domain records (such as associated network infrastructure) and compare them to where the record has pointed before.

With billions of records in a single database, an analyst can pivot and “reverse” search discovered values. This data allows for easily discovering records sharing the same values and infrastructure.

Rebuilding a Coyote Trojan C2 List With Passive DNS Records

Consider the domain cloridatosys[.]com, initially published in a BlackBerry report and linked to the Coyote banking trojan.

The end of the report contains 18 domains related to Coyote. A small subset is shown below.

As an exercise, let’s see if we can take any of these domains individually and then discover the remainder of the list using Passive DNS records.

Let’s start with cloridatosys[.]com.

Searching the domain and browsing the resolutions tab reveal DNS snapshots stored in the Validin database. For our searched domain, there are two NS (Name Server) records, two A (IPv4) records, and one NX record. These records represent changes to the domain’s DNS records over time, shown in the First and Last Seen columns on the right-hand side.

If we observe closely, we can see that the most recent associated IP address is 20.201.119[.]204. The domain first used this IP on 2023-12-20 and is still active as of July 2024.

The power of passive DNS is to discover other domain records associated with the same IPV4 values. This method is a quick and effective way of finding related infrastructure, as domains that have used the same IP address are likely related to the same activity.

To pivot on that resolved IP of  20.201.119[.]204, we can click the IP address directly or copy and paste it into the search bar. This pivot will enable us to see all domains that have shared the same IP address in their DNS records.

Searching for 20.201.119[.]204 and browsing the Resolutions tab reveals 48 domains using the IP.

There are a few too many to fit into a single screenshot, but if we compare just a subset of the results against those shared by BlackBerry, we can see that we have discovered a large number of the same domains.

Exporting and comparing the domains from both Validin and BlackBerry, we can see that this single pivot has captured all 18 domains shared in the BlackBerry report.

Calculating the difference between the two lists of domains, we can see that this simple pivot has discovered 30 additional domains sharing the same IP infrastructure.

Now, it is likely that these are not all linked to Coyote, but it’s interesting to note that the infrastructure is shared and that our search has returned all values shared in the Blackberry report.

Although these additional results may not all be Coyote, all of these domains could be added to a monitoring or block list.

Identifying EugenLoader With Passive DNS Pivots

Let’s look at some domains shared on ThreatFox that are marked as EugenLoader.

Like our Coyote example, we can take any domains above and use passive DNS records to find related infrastructure.

Searching for protonpin[.]com shows 4 associated Nameservers and one associated IPV4 address of 206.206.123[.]151.

We can click on the IP 206.206.123[.]151 directly to perform a pivot and see domains that have shared the same IP value.

This simple pivot reveals multiple domains in the initial intelligence from ThreatFox.

By expanding the results and enabling the Timeline, we can observe many other domains shared on ThreatFox.

Identifying Xworm with Passive DNS Pivots

Let’s look at the domain aprilxrwonew8450.duckdns[.]org, which was initially shared on ThreatFox and linked to Xworm malware.

Xworm is a simple Remote Access Trojan (RAT) written in .NET that is commonly used to steal cryptocurrency accounts.

Searching the domain with Validin, we can observe three distinct A records containing IPV4 addresses used by the Xworm domain.

Pivoting on the A record containing 12.221.146[.]138, we can see the initial domain and dozens of other similarly named domains referencing monthly variants of Xworm infrastructure.

Pivoting on another A record 134.255.217[.]251, we can see another two domains. These domains no longer reference Xworm specifically, but the usage of duckdns and random naming schemes show substantial similarity.

All domains discovered through pivoting like this could be added to a block or alert list and monitored closely. The shared naming schemes and network infrastructure strongly suggest that they are related to malicious activity.

Identifying DCRat Through Subdomain Records

Let’s now look at the domain 640740cm.nyashka[.]top, shared on ThreatFox and linked to DCRat Malware. Dcrat (also known as Dark Crystal Rat) is a simple Remote Access Trojan (RAT) that commonly operates under a low-cost Malware-As-A-Service model.

Searching for this domain in Validin, we can observe ten historical records, all utilizing Cloudflare.

Unfortunately, this limits our pivoting capability on the A records alone, as a CloudFlare IP is often shared between thousands of customers simultaneously, resulting in thousands of “related” domains if we use the same techniques shown in previous examples.

Instead of trying to analyze the CloudFlare IPV4 addresses, we can attempt a pivot on the parent domain.

Parent domains often receive less protection than their subdomain counterparts, so this pivot may lead to more easily analyzed indicators. We can pivot by clicking on the parent domain above our tab menu.

Pivoting reveals that the parent domain of nyashka[.]top is also utilizing Cloudflare for all observed records. So our IPv4 options are limited and we may need to look for other pivot points.

Validin’s Passive DNS records contain detailed information about linked subdomains. By browsing the Subdomains tab for nyashka[.]top, we can observe subdomains that have been observed via DNS records.

This tab shows that 12 domains have been observed under nyashka[.]top, each with near identical naming schemes to our initial indicator 640740cm.nyashka[.]top.

We’ve now discovered 12 domains that are very likely to be related to our initial indicator.

As always, these indicators (with their strong similarity) could all be added to alert or block lists.

Hunting Mint Stealer Through HTML Titles

This technique isn’t strictly passive DNS, but it’s a valuable hunting feature supported by Validin that can lead to new infrastructure.

Let’s take the domain mint-stealer[.]top, initially shared on ThreatFox and linked to Mint Stealer malware.

Searching this domain on Validin, we encounter a passive DNS history with heavy utilization of Cloudflare.

As reported earlier, this complicates our pivots on A/IPv4 records alone.

Instead of relying strictly on Passive DNS, we can move to the Host Responses tab. This will show us any web-related data related to the domain, and can provide a collection of unique values to pivot from.

The Host Responses Tab shows a distinct and unique HTML title referencing Mint Stealer. This value is unique enough (directly referencing the Malware) to be used as a pivot point.

We can pivot on the HTML title by clicking its value directly.

We can then browse the Host Responses tab, which immediately reveals a new domain and IP address using the same HTML Title.

In cases where infrastructure is protected by commercial solutions such as Cloudflare, web-related data can instead be a valuable pivot point.

Conclusion

Passive DNS is a powerful tool that an analyst can utilize to uncover malicious infrastructure.

As shown today, Passive DNS doesn’t need to be complex. Many pivot points take only a few clicks to discover new domains and IOCs.

Validin provides Passive DNS capability in an intuitive and straightforward interface that any analyst can immediately use and benefit from.

Try it out for yourself with our Community Edition or contact us to learn how Validin can support cyber security for your organization.