Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
g01 exploit kit DGA names generator
#! /usr/bin/env ruby
DOMAINS = %w(.doesntexist.com .dnsalias.com .dynalias.com)
DICT = %w(as un si speed no r in me da a o c try to n h call us why q
k old j g how ri i net t ko tu host on ad portal na order b ask l s d
po cat for m off own e f p le is)
DICT_LEN = DICT.length
ts = Time.now.utc
c0 = ts.hour
c1 = ts.day + c0
c2 = ts.month + c1 - 1
c3 = ts.year + c2
d0 = c0 % DICT_LEN
d1 = c1 % DICT_LEN
d2 = c2 % DICT_LEN
d3 = c3 % DICT_LEN
d1 = (d1 + 1) % DICT_LEN if d0 == d1
d2 = (d2 + 1) % DICT_LEN if d1 == d2
d3 = (d3 + 1) % DICT_LEN if d2 == d3
domain = DOMAINS[c0 % DOMAINS.length]
subdomain = [ d0, d1, d2, d3 ].map { |x| DICT[x] }.join
name = subdomain + domain
puts name
@sethhall
Copy link

sethhall commented Mar 15, 2013

Thanks for the script! Is it ok that I ported your script to Bro? https://github.com/sethhall/bro-domain-generation/blob/master/g01pack.bro

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment