New DGA: DNSChanger/Alureon

README.md

@@ -28,3 +28,4 @@ suppobox | SuppoBox | | [link](http://www.rsaconference.com/writable/presentatio
 unnamed_javascript_dga | Unnamed | | [link](https://johannesbader.ch/2015/11/a-javascript-based-dga/) |
 kraken/v1 | Kraken Version 1 | Bobax, Oderoor |  [link](https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/) |
 kraken/v2 | Kraken Version 2 | Bobax, Oderoor |  [link](https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/) |
+dnschanger | DNSChanger | Alureon | [link](https://johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/) |

dnschanger/dga.py

@@ -0,0 +1,32 @@
+import argparse
+from ctypes import c_int
+
+class Rand:
+
+    def __init__(self):
+        self.r = c_int()
+
+    def srand(self, seed):
+        self.r.value = seed
+
+    def rand(self):
+        self.r.value = 214013*self.r.value + 2531011
+        return (self.r.value >> 16) & 0x7FFF
+
+    def randint(self, lower, upper):
+        return lower + self.rand() % (upper - lower + 1)
+
+def dga(r):
+    sld = ''.join([chr(r.randint(ord('a'), ord('z'))) for _ in range(10)])
+    return sld + '.com'
+
+
+if __name__=="__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("seed", type=int)
+    args = parser.parse_args()
+    r = Rand()
+    r.srand(args.seed)
+    for _ in range(5):
+        print(dga(r))
+

dnschanger/example_domains.txt

@@ -0,0 +1,5 @@
+aktklyvbiu.com
+zgimjzlnrl.com
+tcfejerekw.com
+tfaunnjmxt.com
+ydvlfpkguw.com