New DGA: CoreBot

Author: baderj

README.md

@@ -22,3 +22,4 @@ murofet/v1 | Murofet Variant 1 | LICAT | [link](https://johannesbader.ch/2015/09
 murofet/v2 | Murofet Variant 2 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
 murofet/v3 | Murofet Variant 3 | LICAT | [link](https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/)
 fobber     | Fobber | Tinba v3 | |
+corebot    | CoreBot | | [link](https://johannesbader.ch/2015/09/the-dga-of-corebot/)

corebot/dga.py

@@ -0,0 +1,43 @@
+import argparse
+from datetime import datetime
+
+r = 0x1DB98930
+len_l = 0xC
+len_u = 0x18
+
+
+def init_rand_and_chars(year, month, day, nr_b):
+    global r
+    r = (r + year + ((nr_b << 16) + (month << 8) | day)) & 0xFFFFFFFF
+    charset = [chr(x) for x in xrange(ord('a'), ord('z'))] +\
+            [chr(x) for x in xrange(ord('0'), ord('9'))]
+            
+    return charset
+
+def generate_domain(charset):
+    global r
+    r = (1664525*r + 1013904223) & 0xFFFFFFFF
+    domain_len = len_l + r % (len_u - len_l)
+    domain = ""
+    for i in range(domain_len, 0, -1):
+        r = ((1664525 * r) + 1013904223) & 0xFFFFFFFF
+        domain += charset[r % len(charset)] 
+    domain += ".ddns.net"
+    print(domain)
+
+if __name__=="__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-d", "--date", help="date for which to generate domains")
+    parser.add_argument("-n", "--nr", help="nr of domains to generate", type=int, default=40)
+    args = parser.parse_args()
+    if args.date:
+        d = datetime.strptime(args.date, "%Y-%m-%d")
+    else:
+        d = datetime.now()
+
+    charset = init_rand_and_chars(2015, 9, 8, 1) 
+    #charset = init_rand_and_chars(d.year, d.month, 8, 1) 
+    for _ in range(40):
+        generate_domain(charset)
+    
+    

corebot/example_domains.txt

@@ -0,0 +1,40 @@
+lkhylm0mhyfuhg.ddns.net
+s63234wluv5v365bwp5.ddns.net
+afe6mfy23xcxgfa.ddns.net
+7rsl1f34sfq0oj3jwvmfa6c.ddns.net
+ir7l3po0gjy8ypqjm8o.ddns.net
+3lgrupwdivsfm2w4kng2iha.ddns.net
+i8a0q2wdu8otulkfylo2gdq.ddns.net
+kh1her76avy0qnelivijwd1.ddns.net
+ubgp1f1han7lu410eh5.ddns.net
+uliry8knadmpmdm4wti6oro.ddns.net
+g85j7rs4apkfmlqryh7xq6s.ddns.net
+7xcfq4u2ghstaxer5ne.ddns.net
+7xcbe6wtg0o2i0odq6kjyns.ddns.net
+o4kjcxapejwl3h5x3j1.ddns.net
+ghqnw4gle8q2qti.ddns.net
+itgvo6wdwxynmf7v56i.ddns.net
+e8yxa6wfu0yt1vk41xm4k83.ddns.net
+76o2up3p5ly830cho4et50s.ddns.net
+s25be0k0mdgn7hg8ot3fgr7.ddns.net
+eh5favql7fwpmh1.ddns.net
+storip3l7dsdunybebc.ddns.net
+7hidw470qxgjch1nwfw.ddns.net
+1pwr1taxotk4un32gfo.ddns.net
+wrw0w2ulqxcn7lm.ddns.net
+gjw2ini65xi6qr7p7tq.ddns.net
+ybylsvo0ahwpe2i0mdinibo.ddns.net
+mt58e2yvibepeps2mvm.ddns.net
+ebsrkdw2ef32ct3hijen7pm.ddns.net
+u4etk4uta4ang47.ddns.net
+qbk6itife8w2excl3pafsn7.ddns.net
+m0mpihgtmbg05f5dmtax1hq.ddns.net
+gbkdglg2c0q6o6s8ij1.ddns.net
+q072mharq4mpc2y6y8a6i4q.ddns.net
+3fgbyfmxkl5n1fkbs8wjqfm.ddns.net
+c2o8k2ynet72mpevcv72avg.ddns.net
+5h3tkn1psb187xgfghi.ddns.net
+yx167r3nirwbsj70cta.ddns.net
+18i2ejw4ctspqx7.ddns.net
+7bq2qf7hixw21du6of3.ddns.net
+snup5t5tyv1x7pyfoba.ddns.net