Links

• http://johannesbader.ch/2015/02/the-dga-of-banjori/

Beispieldomains

• earnestnessbiophysicalohax.com
• kwtoestnessbiophysicalohax.com
• rvcxestnessbiophysicalohax.com
• hjbtestnessbiophysicalohax.com
• txmoestnessbiophysicalohax.com
• agekestnessbiophysicalohax.com
• dbzwestnessbiophysicalohax.com
• sgjxestnessbiophysicalohax.com
• igjyestnessbiophysicalohax.com
• zxahestnessbiophysicalohax.com

Links

• https://johannesbader.ch/blog/the-dga-of-bazarbackdoor/
• https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/
• https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/

Beispieldomains

Echte DGA:

• adegjkaiggjm.bazar
• eehhjmejjhjo.bazar
• dehiildjjiin.bazar
• ceeiklcjgikn.bazar
• dceikkdhgikm.bazar
• bfehjmbkghjo.bazar
• adegjmaiggjo.bazar
• dchiikdhjiim.bazar
• efehikekghim.bazar
• bdhhjkbijhjm.bazar

Fehlerhafte DGA: -_fdgimzkfgio.bazaar -e`bfkieedfkk.bazaar -efdgikekfgim.bazaar -]begimzgggio.bazaar -bbbfhlbgdfhn.bazaar -^ehikizjjikk.bazaar -aechimajehio.bazaar -]defiizigfik.bazaar -``geiizeieik.bazaar -degfjkdjifjm.bazaar

Beispieldomains

• cmid1s1zeiu.life
• itszko2ot5u.life
• 3v1n35i5kwx.life
• newdnq1xnl9.life
• jkyj6awt1ao.life
• ddrjv6y42b8.life
• 1pnhp5o5za1.life
• y13iqvlfjl5.life
• xp0btfgegbo.life

Links

• https://github.com/360netlab/DGA/issues/1

Beispieldomains

• 8f6bacmw30xxv6sc.cn
• 486txu3yjly0xcmz.ru
• xmi6x8zg9rkanmyo.info
• spy1jhdbmvt2ueva.net
• evybt5gtf2tprvbi.info
• 7qbys97e3pcw262c.info
• kz89iy97c7n7vbur.biz
• zmkvvlsvkbffnuez.ru
• tr1yy6lxtry1gsts.biz
• mfq6uwq3p2hvc8zn.cn

Links

• https://johannesbader.ch/2015/09/the-dga-of-corebot/

Beispieldomains

• lkhylm0mhyfuhg.ddns.net
• s63234wluv5v365bwp5.ddns.net
• afe6mfy23xcxgfa.ddns.net
• 7rsl1f34sfq0oj3jwvmfa6c.ddns.net
• ir7l3po0gjy8ypqjm8o.ddns.net
• 3lgrupwdivsfm2w4kng2iha.ddns.net
• i8a0q2wdu8otulkfylo2gdq.ddns.net
• kh1her76avy0qnelivijwd1.ddns.net
• ubgp1f1han7lu410eh5.ddns.net
• uliry8knadmpmdm4wti6oro.ddns.net

Links

• https://blog.xlab.qianxin.com/uncovering_darkcracks_payload_delivery_framework_cn/#part2-runner%E5%88%86%E6%9E%90

Beispieldomains

• sTDFUgOAgjL.com
• EVDFUgOAgjL.com
• AVDFUgOAgjL.com
• MVDFUgOAgjL.com
• IVDFUgOAgjL.com
• UVDFUgOAgjL.com
• QVDFUgOAgjL.com
• YTCFUgOAgjL.com
• kTCFUgOAgjL.com
• gTCFUgOAgjL.com

Links

• http://johannesbader.ch/2015/03/the-dga-of-dircrypt/

Beispieldomains

• rauggyguyp.com
• llullzza.com
• mluztamhnngwgh.com
• mycojenxktsmozzthdv.com
• inbxvqkegoyapgv.com
• furiararji.com
• zrkdvzjhse.com
• wyuhdsdttczd.com
• hpaxgpkteomjaxywwelr.com
• mydojltbqjnwailyyoa.com

Links

• https://johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/

Beispieldomains

• aktklyvbiu.com
• zgimjzlnrl.com
• tcfejerekw.com
• tfaunnjmxt.com
• ydvlfpkguw.com

Beispieldomains

• vhkintjtksyxgjrzz.net
• btpnxlsfdqbhzazyx.net
• ukfmknjdenthvktgc.net
• qupxsrhrmuoinqrit.net
• gjsbydmrpfzsmnfiu.net
• indpstqbetcpcqprx.net
• gwrdmhyjfcpcutmhp.net
• bwnzcyypcbmnlpfsw.net
• twkpwfuecvvzcincq.net
• pdwfuxgnahmgsxhit.net

Beispieldomains

• app2.winsoft0.com
• app2.winsoft1.com
• app2.winsoft2.com
• app2.winsoft3.com
• app2.winsoft4.com
• app2.winsoft5.com
• app2.winsoft6.com
• app2.winsoft7.com
• app2.winsoft8.com
• app2.winsoft9.com

Links

• http://www.govcert.admin.ch/blog/18/gozi-isfb-when-a-bug-really-is-a-feature

Beispieldomains

• quodpresidentemaxsagit.com
• pertantumfitusu.com
• indulgentiarumlicet.com
• moriblasphemianegocii.com
• ptribueretnossetnonin.com
• nonsicordinario.com
• svivacpecunias.com
• inestimabiler.com
• ulpurgatoriopetrum.com
• papacricognitisipro.com

Links

• https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/

Beispieldomains

• ibbwnhgh.mooo.com
• rbqdxflojkj.mooo.com
• smhburg.dyndns.org
• bltjhzqp.dyndns.org
• clwafrfuuxq.yi.org
• cffxugijxn.yi.org
• ivxcxbj.dynserv.com
• etllejr.dynserv.com
• otpxmk.mooo.com
• ejfjyd.mooo.com

Links

• https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/

Beispieldomains

• xpdbwuimwag.com
• nwpegpjtx.com
• smmyuhxlt.net
• xjvyvnzivvt.net
• lvctmusxcyz.tv
• lvctmusxcyz.tv
• cjuszcfwo.cc
• egbmbdey.cc
• wjxaprgne.com
• vxbuggxhrgi.com

Links

• https://blogs.forcepoint.com/security-labs/lockys-new-dga-seeding-new-domains

Beispieldomains

• gegjiimqmlgtdmk.tf
• pccibcjncnhjn.yt
• rddipikmrap.us
• mmhmkqfc.be
• vkcims.pm
• qtysmobytagnrv.it
• suhpqiumpjsv.ru
• cscffbwbhs.uk

Links

• https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv
• YouTube-Video "Sinkholing the Domain Generation Algorithm of m0yv"

Zeitunabhängige Version in dga.py, zeitabhängige Version in dga-td.py.

Beispieldomains

• pywolwnvd.biz
• ssbzmoy.biz
• cvgrf.biz
• npukfztj.biz
• przvgke.biz
• zlenh.biz
• knjghuig.biz
• uhxqin.biz
• anpmnmxo.biz
• lpuegx.biz

Beispieldomains

• 31b4bd31fg1x2.org
• 31b4bd31fg1x2.tickets
• 31b4bd31fg1x2.blackfriday
• 31b4bd31fg1x2.hosting
• 31b4bd31fg1x2.feedback
• 3f8c8079fd4c5.org
• 3f8c8079fd4c5.tickets
• 3f8c8079fd4c5.blackfriday
• 3f8c8079fd4c5.hosting
• 3f8c8079fd4c5.feedback

Links

• https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/

Beispieldomains

• giywswshrgxcvoqgvrkthmfa.ru
• xaiqpbprgymbvrwmzgiyprgdsk.com
• amgqgularpzxeapztxenbx.net
• pfscijbmthyfiyjgergugtkbqyh.org
• xglfcmsgorvwfilhmzlcxxvkfege.info
• rcteqwkequojntibvfyfaluwh.biz
• mjfqylbiaunffuaeunzdqdwscu.ru
• qobeylpxgpfknlptukyddqvklztg.com
• rgwgizukficdgetwsxovtcknwkfm.info
• betgyaeswxorwcvsdezdupbmb.org

Links

• https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/