Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/baderj/domain_generation_algorithms
Reverse EngineeringMalware AnalysisThreat IntelligenceLearning & EducationCurated ResourcesDNS Analysis
GitHubbaderj/domain_generation_algorithms

domain_generation_algorithms

Some results of my DGA reversing efforts

View Repository
691164111 year agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Domain Generation Algorithms

Domain Generation Algorithms (DGAs) of Malware reimplemented in Python.

Overview

banjori (aka MultiBanker 2, BankPatch(er))

Links

  • http://johannesbader.ch/2015/02/the-dga-of-banjori/

Example Domains

  • earnestnessbiophysicalohax.com
  • kwtoestnessbiophysicalohax.com
  • rvcxestnessbiophysicalohax.com
  • hjbtestnessbiophysicalohax.com
  • txmoestnessbiophysicalohax.com
  • agekestnessbiophysicalohax.com
  • dbzwestnessbiophysicalohax.com
  • sgjxestnessbiophysicalohax.com
  • igjyestnessbiophysicalohax.com
  • zxahestnessbiophysicalohax.com
bazarbackdoor (aka BazarLoader Team9Backdoor))

Links

  • https://johannesbader.ch/blog/the-dga-of-bazarbackdoor/
  • https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/
  • https://johannesbader.ch/blog/the-buggy-dga-of-bazarbackdoor/

Example Domains

Real DGA:

  • adegjkaiggjm.bazar
  • eehhjmejjhjo.bazar
  • dehiildjjiin.bazar
  • ceeiklcjgikn.bazar
  • dceikkdhgikm.bazar
  • bfehjmbkghjo.bazar
  • adegjmaiggjo.bazar
  • dchiikdhjiim.bazar
  • efehikekghim.bazar
  • bdhhjkbijhjm.bazar

Buggy DGA: -_fdgimzkfgio.bazaar -e`bfkieedfkk.bazaar -efdgikekfgim.bazaar -]begimzgggio.bazaar -bbbfhlbgdfhn.bazaar -^ehikizjjikk.bazaar -aechimajehio.bazaar -]defiizigfik.bazaar -``geiizeieik.bazaar -degfjkdjifjm.bazaar

bumblebee

Example Domains

  • cmid1s1zeiu.life
  • itszko2ot5u.life
  • 3v1n35i5kwx.life
  • newdnq1xnl9.life
  • jkyj6awt1ao.life
  • ddrjv6y42b8.life
  • 1pnhp5o5za1.life
  • y13iqvlfjl5.life
  • xp0btfgegbo.life
chinad

Links

  • https://github.com/360netlab/DGA/issues/1

Example Domains

  • 8f6bacmw30xxv6sc.cn
  • 486txu3yjly0xcmz.ru
  • xmi6x8zg9rkanmyo.info
  • spy1jhdbmvt2ueva.net
  • evybt5gtf2tprvbi.info
  • 7qbys97e3pcw262c.info
  • kz89iy97c7n7vbur.biz
  • zmkvvlsvkbffnuez.ru
  • tr1yy6lxtry1gsts.biz
  • mfq6uwq3p2hvc8zn.cn
corebot

Links

  • https://johannesbader.ch/2015/09/the-dga-of-corebot/

Example Domains

  • lkhylm0mhyfuhg.ddns.net
  • s63234wluv5v365bwp5.ddns.net
  • afe6mfy23xcxgfa.ddns.net
  • 7rsl1f34sfq0oj3jwvmfa6c.ddns.net
  • ir7l3po0gjy8ypqjm8o.ddns.net
  • 3lgrupwdivsfm2w4kng2iha.ddns.net
  • i8a0q2wdu8otulkfylo2gdq.ddns.net
  • kh1her76avy0qnelivijwd1.ddns.net
  • ubgp1f1han7lu410eh5.ddns.net
  • uliry8knadmpmdm4wti6oro.ddns.net
darkcracks

Links

  • https://blog.xlab.qianxin.com/uncovering_darkcracks_payload_delivery_framework_cn/#part2-runner%E5%88%86%E6%9E%90

Example Domains

  • sTDFUgOAgjL.com
  • EVDFUgOAgjL.com
  • AVDFUgOAgjL.com
  • MVDFUgOAgjL.com
  • IVDFUgOAgjL.com
  • UVDFUgOAgjL.com
  • QVDFUgOAgjL.com
  • YTCFUgOAgjL.com
  • kTCFUgOAgjL.com
  • gTCFUgOAgjL.com
dircrypt

Links

  • http://johannesbader.ch/2015/03/the-dga-of-dircrypt/

Example Domains

  • rauggyguyp.com
  • llullzza.com
  • mluztamhnngwgh.com
  • mycojenxktsmozzthdv.com
  • inbxvqkegoyapgv.com
  • furiararji.com
  • zrkdvzjhse.com
  • wyuhdsdttczd.com
  • hpaxgpkteomjaxywwelr.com
  • mydojltbqjnwailyyoa.com
dnschanger (aka Alureon)

Links

  • https://johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/

Example Domains

  • aktklyvbiu.com
  • zgimjzlnrl.com
  • tcfejerekw.com
  • tfaunnjmxt.com
  • ydvlfpkguw.com
fobber (aka Tinba v3)

Example Domains

  • vhkintjtksyxgjrzz.net
  • btpnxlsfdqbhzazyx.net
  • ukfmknjdenthvktgc.net
  • qupxsrhrmuoinqrit.net
  • gjsbydmrpfzsmnfiu.net
  • indpstqbetcpcqprx.net
  • gwrdmhyjfcpcutmhp.net
  • bwnzcyypcbmnlpfsw.net
  • twkpwfuecvvzcincq.net
  • pdwfuxgnahmgsxhit.net
fosniw

Example Domains

  • app2.winsoft0.com
  • app2.winsoft1.com
  • app2.winsoft2.com
  • app2.winsoft3.com
  • app2.winsoft4.com
  • app2.winsoft5.com
  • app2.winsoft6.com
  • app2.winsoft7.com
  • app2.winsoft8.com
  • app2.winsoft9.com
gozi (aka Ursnif, Snifula, Papras)

Links

  • http://www.govcert.admin.ch/blog/18/gozi-isfb-when-a-bug-really-is-a-feature

Example Domains

  • quodpresidentemaxsagit.com
  • pertantumfitusu.com
  • indulgentiarumlicet.com
  • moriblasphemianegocii.com
  • ptribueretnossetnonin.com
  • nonsicordinario.com
  • svivacpecunias.com
  • inestimabiler.com
  • ulpurgatoriopetrum.com
  • papacricognitisipro.com
kraken/v1 (aka Bobax, Oderoor)

Links

  • https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/

Example Domains

  • ibbwnhgh.mooo.com
  • rbqdxflojkj.mooo.com
  • smhburg.dyndns.org
  • bltjhzqp.dyndns.org
  • clwafrfuuxq.yi.org
  • cffxugijxn.yi.org
  • ivxcxbj.dynserv.com
  • etllejr.dynserv.com
  • otpxmk.mooo.com
  • ejfjyd.mooo.com
kraken/v2 (aka Bobax, Oderoor)

Links

  • https://johannesbader.ch/2015/12/krakens-two-domain-generation-algorithms/

Example Domains

  • xpdbwuimwag.com
  • nwpegpjtx.com
  • smmyuhxlt.net
  • xjvyvnzivvt.net
  • lvctmusxcyz.tv
  • lvctmusxcyz.tv
  • cjuszcfwo.cc
  • egbmbdey.cc
  • wjxaprgne.com
  • vxbuggxhrgi.com
locky

Links

  • https://blogs.forcepoint.com/security-labs/lockys-new-dga-seeding-new-domains

Example Domains

  • gegjiimqmlgtdmk.tf
  • pccibcjncnhjn.yt
  • rddipikmrap.us
  • mmhmkqfc.be
  • vkcims.pm
  • qtysmobytagnrv.it
  • suhpqiumpjsv.ru
  • cscffbwbhs.uk
m0yv

Links

  • https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv
  • YouTube video "Sinkholing the Domain Generation Algorithm of m0yv"

Time independent version in dga.py, time-dependent version in dga-td.py.

Example Domains

  • pywolwnvd.biz
  • ssbzmoy.biz
  • cvgrf.biz
  • npukfztj.biz
  • przvgke.biz
  • zlenh.biz
  • knjghuig.biz
  • uhxqin.biz
  • anpmnmxo.biz
  • lpuegx.biz
monerodownloader

Example Domains

  • 31b4bd31fg1x2.org
  • 31b4bd31fg1x2.tickets
  • 31b4bd31fg1x2.blackfriday
  • 31b4bd31fg1x2.hosting
  • 31b4bd31fg1x2.feedback
  • 3f8c8079fd4c5.org
  • 3f8c8079fd4c5.tickets
  • 3f8c8079fd4c5.blackfriday
  • 3f8c8079fd4c5.hosting
  • 3f8c8079fd4c5.feedback
murofet/v1 (aka LICAT)

Links

  • https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/

Example Domains

  • giywswshrgxcvoqgvrkthmfa.ru
  • xaiqpbprgymbvrwmzgiyprgdsk.com
  • amgqgularpzxeapztxenbx.net
  • pfscijbmthyfiyjgergugtkbqyh.org
  • xglfcmsgorvwfilhmzlcxxvkfege.info
  • rcteqwkequojntibvfyfaluwh.biz
  • mjfqylbiaunffuaeunzdqdwscu.ru
  • qobeylpxgpfknlptukyddqvklztg.com
  • rgwgizukficdgetwsxovtcknwkfm.info
  • betgyaeswxorwcvsdezdupbmb.org
murofet/v2 (aka LICAT)

Links

  • https://johannesbader.ch/2015/09/three-variants-of-murofets-dga/
Download Tool