Skip to content

Instantly share code, notes, and snippets.

@herrcore
Last active April 29, 2016 16:05
Show Gist options
  • Save herrcore/142b0562c21f4d74b83044f069e0aef2 to your computer and use it in GitHub Desktop.
Save herrcore/142b0562c21f4d74b83044f069e0aef2 to your computer and use it in GitHub Desktop.
DGA for #Dromedan dropper
#!/usr/bin/env python
__AUTHOR__ = '@herrcore'
###############################################################################################
##
## Script to reproduce the DGA for #Dromedan dropper
## Sample SHA256: f88bc84fea3695cd1da1a315eb09c65f21cfc6b764defc3c8efd94d6c6396e0c
##
## Another @herrcore production
##
## And so me put in work work work work work work!
##
#################################################################################################
import argparse
import sys
import os
import json
import re
import uuid
import csv
import datetime
import numpy
class SRand:
def __init__(self, seed):
self.ptd = seed
def rand(self):
p1 = self.ptd * 214013 + 2531011
self.ptd = p1
p2 = p1 >> 16
return p2 & 0x7fff
#thanks to: http://math.stackexchange.com/questions/536847/how-often-in-years-do-calendars-repeat-with-the-same-day-date-combinations-juli
def get_julian_day_number(J):
d4 = (J+31741 - (J % 7)) % 146097 % 36524 % 1461
L = d4/1460
d1 = ((d4-L) % 365) + L
WeekNumber = d1/7+1
return WeekNumber
#thanks to: http://code-highlights.blogspot.ca/2013/01/julian-date-in-python.html
def date_to_julian_day(my_date):
a = (14 - my_date.month)//12
y = my_date.year + 4800 - a
m = my_date.month + 12*a - 3
return my_date.day + ((153*m + 2)//5) + 365*y + y//4 - y//100 + y//400 - 32045
def get_dga_seed(day, month, year):
dt = datetime.datetime(year=year, month=month, day=day)
jd = date_to_julian_day(dt)
return get_julian_day_number(jd)
def get_domain(dga_seed):
#generator is just srand with jd as the seed
srand = SRand(dga_seed)
domain = ""
i = 0
while i < (srand.rand() % 4 + 8):
v4 = srand.rand() % 0x4B + 0x30
if (v4 < ord('0') or v4 > ord('9')) and ((v4 - ord('a'))&0xffffffff > 0x19):
i -= 1
else:
domain += chr(v4)
i +=1
return domain+ ".ru"
def main():
parser = argparse.ArgumentParser(description='Generate Dromedan domain for today.')
subparsers = parser.add_subparsers(help='', dest='subparser_name')
# create the parser for today
parser_today = subparsers.add_parser('today', help="Generate domain for today's date.")
# create the parser for custom
parser_custom = subparsers.add_parser('custom', help='Generate domain for custom date: dd mm yyy.')
parser_custom.add_argument("day", type=int, help="Day; format 00")
parser_custom.add_argument("month", type=int, help="Month; format 00")
parser_custom.add_argument("year", type=int, help="Year; format 0000")
args = parser.parse_args()
if args.subparser_name == "today":
dt = datetime.datetime.now()
dga_seed = get_dga_seed(dt.day, dt.month, dt.year)
print get_domain(dga_seed)
elif args.subparser_name == "custom":
dga_seed = get_dga_seed(int(args.day), int(args.month), int(args.year))
print get_domain(dga_seed)
if __name__ == '__main__':
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment