From VT：2 new seeds of Murofet
suqitian opened this issue · 2 comments
suqitian commented
-
MD5
f9c7354cd1cddac87e23783369af585c -
VT analysis
-
Domains on 2018-01-29
aouotztjyhqfyte.com
aouotztjyhqfyte.org
edsvmmkxelwws.biz
edsvmmkxelwws.info
hsmpxjllqdrqjymp.biz
hsmpxjllqdrqjymp.info
idqitwnirrmjrndn.com
idqitwnirrmjrndn.net
inlomnhpstizqonm.com
inlomnhpstizqonm.net
iofhsqfrtmtzskps.com
iofhsqfrtmtzskps.info
kffownxzwvozvel.com
kffownxzwvozvel.org
kgjtxvnrxwpxxekw.net
kgjtxvnrxwpxxekw.org
kkqzijwkpqphsq.net
kkqzijwkpqphsq.org
kqynjnvlqonocuv.com
kqynjnvlqonocuv.net
...
suqitian commented
-
Seed
0x78e4a3c0 -
The number of domains
1020 -
In order to cover all possibilities, need to generate 1020 domains per day
(17 * second) % 0x3fc
Range of second: [0, 59] -
Test
$python dga.py -k 0x78e4a3c0 -n 1020 -t `date +%s -d "2018-01-29 00:46:32"`
...
aouotztjyhqfyte.org
aouotztjyhqfyte.com
unqrruogowuqpuri.info
unqrruogowuqpuri.org
kvkuiytvrurezqy.biz
kvkuiytvrurezqy.com
iofhsqfrtmtzskps.info
iofhsqfrtmtzskps.com
uiguvtexspoovip.net
uiguvtexspoovip.biz
vyrzisnlohqwesp.info
vyrzisnlohqwesp.com
kffownxzwvozvel.org
kffownxzwvozvel.com
lfkmbbqjnsofheju.biz
lfkmbbqjnsofheju.org
...
suqitian commented
- Another MD5
5df9dc5fb4886a28133656b8c55fd65b - Seed
0xed79a19c - The number of domains
1020 - Test
$ python dga_tdd.py -k 0xed79a19c -n 1020 -t `date +%s -d "2018-04-10 10:00:00"`
wvvqzmrnlpmxwhly.biz
wvvqzmrnlpmxwhly.com
uzorqdovspvfvmvk.net
uzorqdovspvfvmvk.org
vsszqjkqrwumhrtu.info
vsszqjkqrwumhrtu.biz
pmnquslsesxohno.org
pmnquslsesxohno.com
qhzenflonnouslq.info
qhzenflonnouslq.org
xcsquocsngjmmmk.biz
xcsquocsngjmmmk.com
smuqierxxcqqzmn.info
smuqierxxcqqzmn.com
glmhxvfkptpxxri.net
glmhxvfkptpxxri.biz
wrtrjczcysxtmt.info
wrtrjczcysxtmt.com
npgocnmqoyvralq.org
npgocnmqoyvralq.com
lxugqomvmkpzool.biz
lxugqomvmkpzool.org
pkpnaqsmipqdwwh.net
pkpnaqsmipqdwwh.com
rivrovvhcnhhskrn.info
rivrovvhcnhhskrn.biz
osdqwstqvihvxvv.net
osdqwstqvihvxvv.org
tmquwhkklmnqortx.info
tmquwhkklmnqortx.com
llromlolzugnzxs.biz
llromlolzugnzxs.com
...