360netlab/DGA

The DGA of Enviserv

suqitian opened this issue · 1 comments

suqitian commented

  • MD5
    4328048f82811146c0fd9e18faff7155

  • VT analysis

  • Domains generated on 2019/08/06
    fe28753777.com
    9dcd84b090.net
    02261e64b3.org
    20c97d8c3d.info
    5ae4d66001.biz
    e3bea872ae.in
    150d064880.com
    34636b0b94.net
    4e8414394d.org
    d84a6a7a28.info
    ...

  • The threat report from Microsoft.

suqitian commented

  • Thanks to my colleague Jinye for helping reverse engineer binary file.

  • TLDs
    ['com', 'net', 'org', 'info', 'biz', 'in']

  • The number of domains
    500 in total

  • Test

$ python dga.py -n 500
fe28753777.com
9dcd84b090.net
02261e64b3.org
20c97d8c3d.info
5ae4d66001.biz
e3bea872ae.in
150d064880.com
34636b0b94.net
4e8414394d.org
d84a6a7a28.info
......

The output are well-matched to the domains generated by sample.
dga.py is here.