Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
The DGA of Symmi sample b75f00d7ae2857a3e1cc8f5eb4dc11b9
import argparse
from datetime import datetime
seed_const = 42
days_period = 16
nr_of_domains = 64
third_lvl_min_len = 8
third_lvl_max_len = 15
class Rand:
def __init__(self, seed):
self.seed = seed
def rand(self):
self.seed = (self.seed*214013 + 2531011) & 0xFFFFFFFF
return (self.seed >> 16) & 0x7FFF
def next_domain(r, second_and_top_lvl, third_lvl_domain_len):
letters = ["aeiouy", "bcdfghklmnpqrstvwxz"]
domain = ""
for i in range(third_lvl_domain_len):
if not i % 2:
offset_1 = 0 if r.rand() & 0x100 == 0 else 1
s = r.rand()
offset = (offset_1 + i) % 2
symbols = letters[offset]
domain += symbols[s % (len(symbols) - 1)]
return domain + second_and_top_lvl
def dga(seed, second_and_top_lvl, nr):
r = Rand(seed)
for i in range(nr):
span = third_lvl_max_len - third_lvl_min_len + 1
third_lvl_len = third_lvl_min_len + r.rand() % span
print(next_domain(r, second_and_top_lvl, third_lvl_len))
def create_seed(date):
return 10000*(date.day//days_period*100 + date.month) + date.year + seed_const
if __name__=="__main__":
parser = argparse.ArgumentParser()
parser.add_argument("-d", "--date", help="as YYYY-mm-dd")
args = parser.parse_args()
date_str = args.date
if date_str:
date = datetime.strptime(date_str, "%Y-%m-%d")
else:
date = datetime.now()
seed = create_seed(date)
dga(seed, ".ddns.net", nr_of_domains)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment