Yesterday we found out a malware that uses a DGA algorithm to find out the domains of their C&C servers. It become interesting when we noted that the DGA communication is not using periodic requests on purpose. In fact it seems to be specifically generating the requests times of its DGA packets in order to avoid being periodic. 

This blog post is a step by step analysis of a the traffic of a Pushdo malware variant (MD59926b031C7e7dcd2a35786aa78534be8) using the stf program. Its purpose is to show how easy it is to find the C&C channels if we look at the behavioral models.