New DGA of the Ranbyus family

Author: baderj

README.md

@@ -16,7 +16,8 @@ pykspa/precursor    | Precursor of Pykspa | | [link](http://johannesbader.ch/201
 pkyspa/improved     | Improved Pykspa     | | [link](http://johannesbader.ch/2015/03/the-dga-of-pykspa/)
 simda     | Simda | Shiz | [link](http://johannesbader.ch/2015/03/the-dga-of-simda-shiz/)
 tinba     | Tinba | TinyBanker, Zusy  | [link](http://johannesbader.ch/2015/04/new-top-level-domains-for-tinbas-dga/)
-ranbyus   | Ranbyus | | [link](http://johannesbader.ch/2015/05/the-dga-of-ranbyus/)
+ranbyus/may   | Ranbyus Version 1 | | [link](http://johannesbader.ch/2015/05/the-dga-of-ranbyus/)
+ranbyus/september   | Ranbyus Version 2| | [link](http://johannesbader.ch/2015/09/ranbyuss-dga-revisited/)
 nymaim    | Nymaim || 
 murofet/v1 | Murofet Variant 1 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
 murofet/v2 | Murofet Variant 2 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)

corebot/dga.py

@@ -2,6 +2,7 @@
 from datetime import datetime
 
 r = 0x1DB98930
+r = 0x1DBA8930
 len_l = 0xC
 len_u = 0x18
 

ranbyus/dga.c ranbyus/may/dga.cranbyus/dga.c renamed to ranbyus/may/dga.c

@@ -0,0 +1,40 @@
+jxbdxeyxttdmcjagi.me
+iqmadgybfhnrssadm.cc
+gdoldaognceaedkke.su
+jnbnyrmxmpblfgstk.tw
+ucjetnyaitygjidva.net
+jejocqwtcbtuymvao.com
+stuctjsqfxghcesyw.pw
+gfidctymbxiaqyuyk.in
+ojrqwrlhesfshawva.me
+bqjqvwwjirftwkjel.cc
+geaokbyhbipwobgbs.su
+lwdxpevnnuywesula.tw
+gtbsqbmprvomrqfxk.net
+puoxisqhqujojtyiv.com
+hywjcxaqyeuwxkgxb.pw
+sirafunoeqhbdgplq.in
+yrwkhluupptibecuc.me
+eguyyqmedxceevjac.cc
+idbpxcmgepddjmyqi.su
+ncjivathpoitlfkcr.tw
+kwobkvkcjsaovhyun.net
+gumqftsnxhmtkpnxb.com
+erphmciyejfcxjmxp.pw
+ctrkfsehysyqwicdp.in
+xfwpalpigniuoysyc.me
+euxjtulljmitkqafy.cc
+viplfswveevnokpwb.su
+bmhcdqdxnffqnhjyt.tw
+nxmkxdxmmhgfydqto.net
+gcrgrwnspktuxqnfs.com
+bwuercxgoofjtuetg.pw
+kyfscrqqmxyfjhnlj.in
+khygvhpwmsnmmekep.me
+oygtjnnakklguansa.cc
+bflnbgysenbifhkmb.su
+nydtahuylrfdjokyc.tw
+ucfpxrqcjrivyydwo.net
+qvhrubcrjrappaxle.com
+tuusskblufagqnjan.pw
+bcfuvigfodpidtlmq.in

ranbyus/example_domains.txt ranbyus/may/example_domains.txtranbyus/example_domains.txt renamed to ranbyus/may/example_domains.txt

@@ -0,0 +1,63 @@
+import argparse
+from datetime import datetime
+
+def to_little_array(val):
+    a = 4*[0]
+    for i in range(4):
+        a[i] = (val & 0xFF)
+        val >>= 8
+    return a
+        
+def pcg_random(r): 
+    alpha = 0x5851F42D4C957F2D
+    inc = 0x14057B7EF767814F
+
+    step1 = alpha*r + inc
+    step2 = alpha*step1 + inc
+    step3 = alpha*step2 + inc
+
+    tmp = (step3 >> 24) & 0xFFFFFF00 | (step3  & 0xFFFFFFFF) >> 24
+    a = (tmp ^ step2) & 0x000FFFFF ^ step2
+    b = (step2 >> 32)
+    c = (step1 & 0xFFF00000)  | ((step3 >> 32) & 0xFFFFFFFF) >> 12
+    d = (step1 >> 32) & 0xFFFFFFFF
+
+    data = 32*[None]
+    data[0:4] = to_little_array(a)
+    data[4:8] = to_little_array(b)
+    data[8:12] = to_little_array(c)
+    data[12:16] = to_little_array(d)
+    return step3 & 0xFFFFFFFFFFFFFFFF, data
+
+def dga(year, month, day, seed):
+    x = (day*month*year) ^ seed
+    tld_index = day
+    for _ in range(40):
+        random = 32*[None]
+        x, random[0:16] = pcg_random(x)
+        x, random[16:32] = pcg_random(x)
+
+        domain = ""
+        for i in range(17):
+            domain += chr(random[i] % 25 + ord('a'))
+        tlds =  ["in", "me", "cc", "su", "tw", "net", "com", "pw", "org"]
+        domain += '.' + tlds[tld_index % (len(tlds) - 1)]
+        tld_index += 1
+        yield domain
+
+if __name__=="__main__":
+    """
+        known seeds are: 
+            - 0F0D5BFA
+            - F2C72B14
+    """
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-d", "--date", help="date for which to generate domains")
+    parser.add_argument("-s", "--seed", help="seed as hex string", default="0F0D5BFA")
+    args = parser.parse_args()
+    if args.date:
+        d = datetime.strptime(args.date, "%Y-%m-%d")
+    else:
+        d = datetime.now()
+    for domain in dga(d.year, d.month, d.day, int(args.seed, 16)):
+        print(domain)