Skip to content

Commit

Permalink
DGA of Fobber (two versions)
Browse files Browse the repository at this point in the history
  • Loading branch information
baderj committed Sep 11, 2015
1 parent f975979 commit 5881410
Show file tree
Hide file tree
Showing 4 changed files with 640 additions and 0 deletions.
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,4 @@ nymaim | Nymaim ||
murofet/v1 | Murofet Variant 1 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
murofet/v2 | Murofet Variant 2 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
murofet/v3 | Murofet Variant 3 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
fobber | Fobber | Tinba v3 | |
39 changes: 39 additions & 0 deletions fobber/dga.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
import argparse

def ror32(v, n):
return ((v >> n) | (v << (32-n))) & 0xFFFFFFFF

def next_domain(r, c, l, tld):
domain = ""
for _ in range(l):
r = ror32((321167 * r + c) & 0xFFFFFFFF, 16);
domain += chr( (r & 0x17FF) % 26 + ord('a') )

domain += tld
print(domain)
return r

def dga(version):
if version == 1:
r = 0xC87C8A78
c = -1719405398
l = 17
tld = '.net'
nr = 300
elif version == 2:
r = 0x851A3E59
c = -1916503263
l = 10
tld = '.com'
nr = 300
for _ in range(nr):
r = next_domain(r, c, l, tld)

if __name__=="__main__":
parser = argparse.ArgumentParser(description="DGA of Fobber")
parser.add_argument("version", choices=[1,2], type=int)
args = parser.parse_args()
dga(args.version)



300 changes: 300 additions & 0 deletions fobber/domains_1.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,300 @@
vhkintjtksyxgjrzz.net
btpnxlsfdqbhzazyx.net
ukfmknjdenthvktgc.net
qupxsrhrmuoinqrit.net
gjsbydmrpfzsmnfiu.net
indpstqbetcpcqprx.net
gwrdmhyjfcpcutmhp.net
bwnzcyypcbmnlpfsw.net
twkpwfuecvvzcincq.net
pdwfuxgnahmgsxhit.net
jyalcixnmcjafecuk.net
ocwhgfvoqhkdsrtjl.net
wfzuuinpiteusxqfo.net
xgsqljmoypxbflety.net
bnxnjmsuhiyvoclzi.net
zzwzzqmihkfdevymi.net
hxiwupwmcezqutijl.net
oasmavkjmcxctdkit.net
kazrkkpoctlrwosko.net
hnzxwfgzhsklpxfpi.net
xqpupbzusybgfgvvx.net
bbhyavqhajidcsbaw.net
ejwmitqbpslotdeti.net
kyebzahocfnbjqfop.net
wcestskyuqgccngso.net
eyvidvnoauypjemvu.net
xuofceqidwaywjakb.net
zkqjudemdkilrpkpl.net
skibtcahjusojmsco.net
yyepzaiorikkpqfrw.net
gawexrwnbmjyuydwd.net
olshysihdrvhdxejs.net
ylkbpbhugoyzxybkq.net
rxijmcnwxcmsqjtfe.net
lopqmutrecwilhzya.net
rlgobqspihlitgcwt.net
krycuzksjfdhzxvce.net
huqmvuhpympwxeepk.net
sxusokhgyabeenrsr.net
earikhmgbkzfyhbcz.net
nqdpwyfiwlejmpibl.net
hfuwlocyqngcsblek.net
rluleaowkokspaphp.net
udgvpggiwfygnupoi.net
bocwykwkemkxjrgaj.net
cnzznfaeyqjbgcpim.net
mfnstdvwsqdrrheod.net
wsdyrkavxcoglsccf.net
bjsebkduyxltfyzeo.net
yofyxitpppepnkmhp.net
xyypnmspbpkretqwy.net
rclcvcmhgaxeyeymc.net
eeosqcieuhtffrjaa.net
rvvxunhtmdxlglflr.net
esgdocrchkqcqkgah.net
nsqbbiwkvilifchal.net
hpxbzwvnzwbrdcoqi.net
spqrqgvkvijzktxgy.net
chxdxtpmkhtvqpiwu.net
zncnqbvqjdrcugowl.net
pjdhyhfvfoubfkkhb.net
mirxioqhbtnrfybsu.net
pfowknzscvigndsrn.net
higefgtismzjpicfv.net
jihkfowhhgczudsks.net
dzwaqprcaiyggchhh.net
qyyljhehdziswvmtg.net
vfzuxzvfggfksfnhp.net
jvzlwbvwebzcyinto.net
kmwgpvqkdjnazlfet.net
kyshkzrywomdwxavn.net
byxfppghcvyilbsye.net
modjanozwilxmcpjf.net
dipoivuunjnnmvogz.net
afspszuhaayetuyqb.net
fvfhyqhklwgwiodqw.net
xpndsvedrhcfswnxq.net
gmjopuorweeetwtnk.net
bomekvpgozudpjavt.net
aojprjumtushglzud.net
aaigvwqjqgvetozdw.net
oapuwvvkjhaickavs.net
ipemwjmehydqbezyr.net
stxblrfbspjbquwfz.net
irxjakljhgazxdkyb.net
sxrexqqppzfpvgnen.net
pmpwkcohnvjmphwvo.net
efzswngeqtqqlumic.net
bnpjzrxbvimnjggni.net
akcwxmqhkmelvktni.net
runezidldmvfwmpbb.net
cpieefprahrnadxwd.net
voamlofbhihesapjs.net
vupjvpafagvioioov.net
mdbvdcvuovfcejsek.net
qqiqugnqdjoahqdke.net
ryylwjmkwbeaajmvx.net
xtocrppzqroqtcnqe.net
zndoqnjvzlagxiiit.net
xchlgxadnujwsvpda.net
ftwiknztddqdtuxuc.net
cbmnushazjlmqezpv.net
twfaukbyawpbxksms.net
sxbfkpfnngudyqapd.net
snozdqpobevjiyumm.net
fhjrkmsricizgsfef.net
uslohivkmodsmxcnq.net
qdqcpphtzbietftvf.net
vrttzyjwfvodogvfo.net
wwqqgjugkplyfckfj.net
uipdyeshplmhqmodq.net
ffnqmeosxrgndqlss.net
racpizlymtqmnsisz.net
sqddhajtcqpgbxuzq.net
faxgklnkemobryxvj.net
rqvkpdsnmomxsihqe.net
dvxqzgkvvanrkdcjy.net
fzlkwtlxcnlgmktqo.net
pfpjpsdohqqkjuajg.net
ayppvfettvcxdosqu.net
quwznwlififjkbrhu.net
yjcsvfuwlhnlpiump.net
wjluspergnieusdqy.net
agrxjkeicnhlrkegx.net
xalkxchekclftmggn.net
gcuqvvignuujagtgm.net
dxxocpvxtgesowjwx.net
nmzrnfvmguuhqtwko.net
hfoghkhpszieqzlxt.net
zahtwdxjwkhakkrtm.net
ahtsvrcvjwwthtwhy.net
hgrwceibjfshvovop.net
aaibkbnkncaxyjiph.net
zqsvhefqxbzmdzwbi.net
czpplrevxhocanmtg.net
nfssvjxpsjbxnnnne.net
caopxcmamyjbmpdjx.net
iwapfmliiiynyupip.net
upfugycewskkkugbi.net
fcdwhvsvxtpsvvogi.net
jiucamipxerdtgbrx.net
vfyhsohxsaaqqvxbh.net
iupcfuynvevwxdmgn.net
twwuaaoqyfjpguhvs.net
htogunltchaotqhjp.net
nuxbrgcdcpogpfxuw.net
peajlgxrbqoeadpad.net
zezvqibtzqbcluoex.net
ziqaybvwtdwpbvmyv.net
jbaxggokstfkgctzs.net
xgrjtphhudgxqkmwu.net
asqxxkjukkywzxhwk.net
lxhzmwsplrnzhkxbw.net
mlukyfzkksbamulfs.net
mcbjoiwbhhnledflx.net
ltfsdzyufdyyridnx.net
dnbfgwiirpznywcmb.net
sqckhaalebvsuqbvv.net
plejrphenceowhzfa.net
sjqrrfbldqtupdpcc.net
xjjdaelbdmqdvzwxu.net
yvcuxfpidoirdvlcj.net
jqrujfrwqzyffgwnr.net
sqqeafgxqkgfdarwm.net
zoobnlxietowbwvru.net
dmjtbnshcfvxmlytj.net
qqbionhvmsklpjrwr.net
dfynklojexrpdagcs.net
zmifuyaiszgsdevky.net
sziaatpcelbbsjzyg.net
toulwebvrmzgeaovs.net
yqffqfmqzimpxccaf.net
nzqtdcuxxiwmxdrlq.net
jtacxyhwjgynyvyxh.net
mcnzpvmsmdumjexpu.net
xjbdxczikbupzkigr.net
ynhqecetcmpbfaymf.net
ylhjpgugvrmnsltcw.net
pkfodfbnlnmlouddu.net
gsjldoolhamvcdczq.net
alwtxhdrmbfkaqtuh.net
nwjhdzcyyrqavbxlf.net
hiwymketrprfrnszb.net
mjhybicsrokulojux.net
cmknxgxhqtqrrniri.net
yejidyddpgjfpjnuy.net
deqydieharyfjczuh.net
evgjdtfvhtvitxllc.net
mfalcyxqkphekcgjd.net
mobgpkqdnasiymbzd.net
yjbpmtmkirzdyddch.net
rskzstrrdvigduezw.net
gwgdgyyfdbqwisjtu.net
prdorofeqssdpqlob.net
jaxpfuzrswwdniolm.net
pgyiycgfluyhtznwp.net
mrtgfydwimlkhpesx.net
dfqqtcthmkscufqot.net
uzmwutxnzppfierkw.net
dmtekexdhjbvfzurg.net
mrxcobbrarvtojanm.net
jwjcsiqamawlrpkzd.net
lhthslqbrtfcesdkl.net
itlmorhlrkbdcwkuz.net
ybxxfskgpzsabdhzo.net
kloeanntbaqpwwhcq.net
edhmiicqapfafigag.net
mpfjuuumfkafwkpww.net
qftwreeggbaqekmbm.net
xkwsegqqumjitlxre.net
bnpdwvkszmlulhjxn.net
qbjlxgnyplggcxfox.net
buxmjixeeuibvxfga.net
yevxijrkweizpocay.net
vdjmvqpldivjcuarx.net
cobjjozfxzadnvzvn.net
ucrzhkiyevxawllez.net
cmnjbshnuyruyruyo.net
odialbnsuwxntzdax.net
dzknlhmbjckfdyrkr.net
lklocuuewuzxqwnjb.net
zwjucghgivhgfalyt.net
atciwfktatcyoglqv.net
zgveislvkdqfuetkv.net
iouffotvoghwsliob.net
gqsgjgdmspvmqsubm.net
chzmanebpsffopqsy.net
bygfktpcsuyidumdp.net
xeajepyogqmcjtjfy.net
lrgxwsixrhonlvxxb.net
oxrdpheoxvkcjcaic.net
yfnthjickhnqqhihr.net
zlelphnjifgwbsmbt.net
dbbbysvicxqxsllkd.net
tlfhdgjnmuxqxxjug.net
xgrfifatjtxhpluno.net
adbhahxbbjvnhqvsi.net
npjlrzkchbuxwswdo.net
whbqgvtpxpvqpdjgf.net
mmbhkhzkxcpscrgox.net
mrkrrmsogajlphleb.net
xaamfjkacparrpwru.net
sixuxccmndcgekpqc.net
wvqepmqsonukotfxs.net
elxjrvicgywdgyiwh.net
ppbcekzkrhoekatbi.net
sltuxjapvjktnzivb.net
uvlamodkirlflmgya.net
hlhqqurbwwnoealln.net
qtofngfdsmhzweviv.net
ujublxpvoiiyxjnhx.net
drusoqglcvrxmmfol.net
lewpzozzuqlfzutyj.net
mhbbdxqwnixfplumf.net
qdklotayyhtbojayk.net
gkosiwifutyjdgcgq.net
vvcwjhybrredyqtbt.net
kosmghqxwzptopbif.net
wtbjfgnbnftqjauao.net
pssbkwtszotaspajv.net
eoxsrihuafnrwuoqb.net
fdfcyhmcdwwlwmtgh.net
sjsdqyiqtawqlmjor.net
pukgwpjgwavskixxc.net
qbiipkmvoxmaberig.net
trayuhsdljzohffkk.net
juscmgowenjxfknfh.net
rhukqkajqgrqhnxsp.net
ilzkojumbiukzepvj.net
mijceviwqrvyszrcd.net
cbnoioiyaxeajwqat.net
ftwsldgsxysldaqfp.net
fvkxnhchvpuptqiqu.net
evcvcjfnreiyfhums.net
kmdebgcdxordxmyaf.net
wwlddyybdialbqzky.net
tcbrhwfljdsnemyft.net
qxwqcgjbsikwjuhim.net
zcfqyouupmewphrub.net
znnyqzpmxxamqyies.net
dxeqiajhktbdddlak.net
yomaebzlsinlytabp.net
kqfkxfruovrqvchte.net
ucxhnjblzylfpsydk.net
dgcrwysklrrlvkgyo.net
twvfmrqioppvienlp.net
hztmvfeqrhwunvhvo.net
tiapqndjbeoqfnyjd.net
zlcacccqyhshoqycc.net
ugovykiwouxhdlrtj.net
wocctmuequihogthl.net
aegqdrswgitmmitfx.net
ilewetdbqxwwotpdz.net
bctqdlevgzzpcpayr.net
mqupsqypbscfbyjyk.net
lyljcvsnamunscmkt.net
rhajltlqwfnziyenl.net
muarqmwufxcosuqpz.net
klciaqpacbobjfffc.net
bawnzaqqtlflnzoze.net
Loading

0 comments on commit 5881410

Please sign in to comment.