DGA of Fobber (two versions)

Author: baderj

README.md

@@ -21,3 +21,4 @@ nymaim    | Nymaim ||
 murofet/v1 | Murofet Variant 1 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
 murofet/v2 | Murofet Variant 2 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
 murofet/v3 | Murofet Variant 3 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
+fobber     | Fobber | Tinba v3 | |

fobber/dga.py

@@ -0,0 +1,39 @@
+import argparse
+
+def ror32(v, n):
+    return ((v >> n) | (v << (32-n))) & 0xFFFFFFFF
+
+def next_domain(r, c, l, tld):
+    domain = ""
+    for _ in range(l):
+        r = ror32((321167 * r + c) & 0xFFFFFFFF, 16);
+        domain += chr( (r & 0x17FF) % 26 + ord('a') )
+
+    domain += tld 
+    print(domain)
+    return r
+
+def dga(version):
+    if version == 1:
+        r = 0xC87C8A78
+        c = -1719405398
+        l = 17
+        tld = '.net'
+        nr = 300
+    elif version == 2:
+        r = 0x851A3E59
+        c = -1916503263
+        l = 10
+        tld = '.com'
+        nr = 300
+    for _ in range(nr):
+        r = next_domain(r, c, l, tld)
+
+if __name__=="__main__":
+    parser = argparse.ArgumentParser(description="DGA of Fobber")
+    parser.add_argument("version", choices=[1,2], type=int)
+    args = parser.parse_args()
+    dga(args.version)
+
+
+

fobber/domains_1.txt

@@ -0,0 +1,300 @@
+vhkintjtksyxgjrzz.net
+btpnxlsfdqbhzazyx.net
+ukfmknjdenthvktgc.net
+qupxsrhrmuoinqrit.net
+gjsbydmrpfzsmnfiu.net
+indpstqbetcpcqprx.net
+gwrdmhyjfcpcutmhp.net
+bwnzcyypcbmnlpfsw.net
+twkpwfuecvvzcincq.net
+pdwfuxgnahmgsxhit.net
+jyalcixnmcjafecuk.net
+ocwhgfvoqhkdsrtjl.net
+wfzuuinpiteusxqfo.net
+xgsqljmoypxbflety.net
+bnxnjmsuhiyvoclzi.net
+zzwzzqmihkfdevymi.net
+hxiwupwmcezqutijl.net
+oasmavkjmcxctdkit.net
+kazrkkpoctlrwosko.net
+hnzxwfgzhsklpxfpi.net
+xqpupbzusybgfgvvx.net
+bbhyavqhajidcsbaw.net
+ejwmitqbpslotdeti.net
+kyebzahocfnbjqfop.net
+wcestskyuqgccngso.net
+eyvidvnoauypjemvu.net
+xuofceqidwaywjakb.net
+zkqjudemdkilrpkpl.net
+skibtcahjusojmsco.net
+yyepzaiorikkpqfrw.net
+gawexrwnbmjyuydwd.net
+olshysihdrvhdxejs.net
+ylkbpbhugoyzxybkq.net
+rxijmcnwxcmsqjtfe.net
+lopqmutrecwilhzya.net
+rlgobqspihlitgcwt.net
+krycuzksjfdhzxvce.net
+huqmvuhpympwxeepk.net
+sxusokhgyabeenrsr.net
+earikhmgbkzfyhbcz.net
+nqdpwyfiwlejmpibl.net
+hfuwlocyqngcsblek.net
+rluleaowkokspaphp.net
+udgvpggiwfygnupoi.net
+bocwykwkemkxjrgaj.net
+cnzznfaeyqjbgcpim.net
+mfnstdvwsqdrrheod.net
+wsdyrkavxcoglsccf.net
+bjsebkduyxltfyzeo.net
+yofyxitpppepnkmhp.net
+xyypnmspbpkretqwy.net
+rclcvcmhgaxeyeymc.net
+eeosqcieuhtffrjaa.net
+rvvxunhtmdxlglflr.net
+esgdocrchkqcqkgah.net
+nsqbbiwkvilifchal.net
+hpxbzwvnzwbrdcoqi.net
+spqrqgvkvijzktxgy.net
+chxdxtpmkhtvqpiwu.net
+zncnqbvqjdrcugowl.net
+pjdhyhfvfoubfkkhb.net
+mirxioqhbtnrfybsu.net
+pfowknzscvigndsrn.net
+higefgtismzjpicfv.net
+jihkfowhhgczudsks.net
+dzwaqprcaiyggchhh.net
+qyyljhehdziswvmtg.net
+vfzuxzvfggfksfnhp.net
+jvzlwbvwebzcyinto.net
+kmwgpvqkdjnazlfet.net
+kyshkzrywomdwxavn.net
+byxfppghcvyilbsye.net
+modjanozwilxmcpjf.net
+dipoivuunjnnmvogz.net
+afspszuhaayetuyqb.net
+fvfhyqhklwgwiodqw.net
+xpndsvedrhcfswnxq.net
+gmjopuorweeetwtnk.net
+bomekvpgozudpjavt.net
+aojprjumtushglzud.net
+aaigvwqjqgvetozdw.net
+oapuwvvkjhaickavs.net
+ipemwjmehydqbezyr.net
+stxblrfbspjbquwfz.net
+irxjakljhgazxdkyb.net
+sxrexqqppzfpvgnen.net
+pmpwkcohnvjmphwvo.net
+efzswngeqtqqlumic.net
+bnpjzrxbvimnjggni.net
+akcwxmqhkmelvktni.net
+runezidldmvfwmpbb.net
+cpieefprahrnadxwd.net
+voamlofbhihesapjs.net
+vupjvpafagvioioov.net
+mdbvdcvuovfcejsek.net
+qqiqugnqdjoahqdke.net
+ryylwjmkwbeaajmvx.net
+xtocrppzqroqtcnqe.net
+zndoqnjvzlagxiiit.net
+xchlgxadnujwsvpda.net
+ftwiknztddqdtuxuc.net
+cbmnushazjlmqezpv.net
+twfaukbyawpbxksms.net
+sxbfkpfnngudyqapd.net
+snozdqpobevjiyumm.net
+fhjrkmsricizgsfef.net
+uslohivkmodsmxcnq.net
+qdqcpphtzbietftvf.net
+vrttzyjwfvodogvfo.net
+wwqqgjugkplyfckfj.net
+uipdyeshplmhqmodq.net
+ffnqmeosxrgndqlss.net
+racpizlymtqmnsisz.net
+sqddhajtcqpgbxuzq.net
+faxgklnkemobryxvj.net
+rqvkpdsnmomxsihqe.net
+dvxqzgkvvanrkdcjy.net
+fzlkwtlxcnlgmktqo.net
+pfpjpsdohqqkjuajg.net
+ayppvfettvcxdosqu.net
+quwznwlififjkbrhu.net
+yjcsvfuwlhnlpiump.net
+wjluspergnieusdqy.net
+agrxjkeicnhlrkegx.net
+xalkxchekclftmggn.net
+gcuqvvignuujagtgm.net
+dxxocpvxtgesowjwx.net
+nmzrnfvmguuhqtwko.net
+hfoghkhpszieqzlxt.net
+zahtwdxjwkhakkrtm.net
+ahtsvrcvjwwthtwhy.net
+hgrwceibjfshvovop.net
+aaibkbnkncaxyjiph.net
+zqsvhefqxbzmdzwbi.net
+czpplrevxhocanmtg.net
+nfssvjxpsjbxnnnne.net
+caopxcmamyjbmpdjx.net
+iwapfmliiiynyupip.net
+upfugycewskkkugbi.net
+fcdwhvsvxtpsvvogi.net
+jiucamipxerdtgbrx.net
+vfyhsohxsaaqqvxbh.net
+iupcfuynvevwxdmgn.net
+twwuaaoqyfjpguhvs.net
+htogunltchaotqhjp.net
+nuxbrgcdcpogpfxuw.net
+peajlgxrbqoeadpad.net
+zezvqibtzqbcluoex.net
+ziqaybvwtdwpbvmyv.net
+jbaxggokstfkgctzs.net
+xgrjtphhudgxqkmwu.net
+asqxxkjukkywzxhwk.net
+lxhzmwsplrnzhkxbw.net
+mlukyfzkksbamulfs.net
+mcbjoiwbhhnledflx.net
+ltfsdzyufdyyridnx.net
+dnbfgwiirpznywcmb.net
+sqckhaalebvsuqbvv.net
+plejrphenceowhzfa.net
+sjqrrfbldqtupdpcc.net
+xjjdaelbdmqdvzwxu.net
+yvcuxfpidoirdvlcj.net
+jqrujfrwqzyffgwnr.net
+sqqeafgxqkgfdarwm.net
+zoobnlxietowbwvru.net
+dmjtbnshcfvxmlytj.net
+qqbionhvmsklpjrwr.net
+dfynklojexrpdagcs.net
+zmifuyaiszgsdevky.net
+sziaatpcelbbsjzyg.net
+toulwebvrmzgeaovs.net
+yqffqfmqzimpxccaf.net
+nzqtdcuxxiwmxdrlq.net
+jtacxyhwjgynyvyxh.net
+mcnzpvmsmdumjexpu.net
+xjbdxczikbupzkigr.net
+ynhqecetcmpbfaymf.net
+ylhjpgugvrmnsltcw.net
+pkfodfbnlnmlouddu.net
+gsjldoolhamvcdczq.net
+alwtxhdrmbfkaqtuh.net
+nwjhdzcyyrqavbxlf.net
+hiwymketrprfrnszb.net
+mjhybicsrokulojux.net
+cmknxgxhqtqrrniri.net
+yejidyddpgjfpjnuy.net
+deqydieharyfjczuh.net
+evgjdtfvhtvitxllc.net
+mfalcyxqkphekcgjd.net
+mobgpkqdnasiymbzd.net
+yjbpmtmkirzdyddch.net
+rskzstrrdvigduezw.net
+gwgdgyyfdbqwisjtu.net
+prdorofeqssdpqlob.net
+jaxpfuzrswwdniolm.net
+pgyiycgfluyhtznwp.net
+mrtgfydwimlkhpesx.net
+dfqqtcthmkscufqot.net
+uzmwutxnzppfierkw.net
+dmtekexdhjbvfzurg.net
+mrxcobbrarvtojanm.net
+jwjcsiqamawlrpkzd.net
+lhthslqbrtfcesdkl.net
+itlmorhlrkbdcwkuz.net
+ybxxfskgpzsabdhzo.net
+kloeanntbaqpwwhcq.net
+edhmiicqapfafigag.net
+mpfjuuumfkafwkpww.net
+qftwreeggbaqekmbm.net
+xkwsegqqumjitlxre.net
+bnpdwvkszmlulhjxn.net
+qbjlxgnyplggcxfox.net
+buxmjixeeuibvxfga.net
+yevxijrkweizpocay.net
+vdjmvqpldivjcuarx.net
+cobjjozfxzadnvzvn.net
+ucrzhkiyevxawllez.net
+cmnjbshnuyruyruyo.net
+odialbnsuwxntzdax.net
+dzknlhmbjckfdyrkr.net
+lklocuuewuzxqwnjb.net
+zwjucghgivhgfalyt.net
+atciwfktatcyoglqv.net
+zgveislvkdqfuetkv.net
+iouffotvoghwsliob.net
+gqsgjgdmspvmqsubm.net
+chzmanebpsffopqsy.net
+bygfktpcsuyidumdp.net
+xeajepyogqmcjtjfy.net
+lrgxwsixrhonlvxxb.net
+oxrdpheoxvkcjcaic.net
+yfnthjickhnqqhihr.net
+zlelphnjifgwbsmbt.net
+dbbbysvicxqxsllkd.net
+tlfhdgjnmuxqxxjug.net
+xgrfifatjtxhpluno.net
+adbhahxbbjvnhqvsi.net
+npjlrzkchbuxwswdo.net
+whbqgvtpxpvqpdjgf.net
+mmbhkhzkxcpscrgox.net
+mrkrrmsogajlphleb.net
+xaamfjkacparrpwru.net
+sixuxccmndcgekpqc.net
+wvqepmqsonukotfxs.net
+elxjrvicgywdgyiwh.net
+ppbcekzkrhoekatbi.net
+sltuxjapvjktnzivb.net
+uvlamodkirlflmgya.net
+hlhqqurbwwnoealln.net
+qtofngfdsmhzweviv.net
+ujublxpvoiiyxjnhx.net
+drusoqglcvrxmmfol.net
+lewpzozzuqlfzutyj.net
+mhbbdxqwnixfplumf.net
+qdklotayyhtbojayk.net
+gkosiwifutyjdgcgq.net
+vvcwjhybrredyqtbt.net
+kosmghqxwzptopbif.net
+wtbjfgnbnftqjauao.net
+pssbkwtszotaspajv.net
+eoxsrihuafnrwuoqb.net
+fdfcyhmcdwwlwmtgh.net
+sjsdqyiqtawqlmjor.net
+pukgwpjgwavskixxc.net
+qbiipkmvoxmaberig.net
+trayuhsdljzohffkk.net
+juscmgowenjxfknfh.net
+rhukqkajqgrqhnxsp.net
+ilzkojumbiukzepvj.net
+mijceviwqrvyszrcd.net
+cbnoioiyaxeajwqat.net
+ftwsldgsxysldaqfp.net
+fvkxnhchvpuptqiqu.net
+evcvcjfnreiyfhums.net
+kmdebgcdxordxmyaf.net
+wwlddyybdialbqzky.net
+tcbrhwfljdsnemyft.net
+qxwqcgjbsikwjuhim.net
+zcfqyouupmewphrub.net
+znnyqzpmxxamqyies.net
+dxeqiajhktbdddlak.net
+yomaebzlsinlytabp.net
+kqfkxfruovrqvchte.net
+ucxhnjblzylfpsydk.net
+dgcrwysklrrlvkgyo.net
+twvfmrqioppvienlp.net
+hztmvfeqrhwunvhvo.net
+tiapqndjbeoqfnyjd.net
+zlcacccqyhshoqycc.net
+ugovykiwouxhdlrtj.net
+wocctmuequihogthl.net
+aegqdrswgitmmitfx.net
+ilewetdbqxwwotpdz.net
+bctqdlevgzzpcpayr.net
+mqupsqypbscfbyjyk.net
+lyljcvsnamunscmkt.net
+rhajltlqwfnziyenl.net
+muarqmwufxcosuqpz.net
+klciaqpacbobjfffc.net
+bawnzaqqtlflnzoze.net