SecsAndCyber/dga-collection

A collection of known Domain Generation Algorithms

DGA Collection

A collection of known Domain Generation Algorithms:

• Torpig
• ZeusBot
• Cryptolocker
• Necurs
• Symmi
• Ranbyus

Usage

For each DGA, the list of domains can be easily generated:

from datetime import date
from Necurs import Necurs

# Compute domains for the current day/period:
Necurs.domains()

# Compute domains for a given date:
Necurs.domainsFor(date(2015, 1, 20))

The couldUseDomain method can also prove useful to help classify domains:

Necurs.couldUseDomain('thislabelcontainsaz.biz')
# => False

Necurs.couldUseDomain('boymlujtgp.nu')
# => True

Contributing

Please see CONTRIBUTING.md for instructions on how to add a new DGA.

License

This project is under MIT license.

It uses results from reverse-engineering analyses published on various blogs including:

• Johannes Bader's blog
• VRT blog
• Fortinet blog