search

360netlab / DGA

Suspicious DGA from PDNS and Sandbox.
MIT License
182 stars 35 forks source link

From Sandbox: New seed of Padcrypt #34

Open suqitian opened 7 years ago

suqitian commented 7 years ago
suqitian commented 7 years ago 
$ diff dga_new.py dga.py 
30,36d29
<         },
<     "11.37.0.0" : {
<         'nr_domains': 24*3,
<         'tlds': ['com', 'co.uk', 'de', 'org', 'net', 'tk', 'info', 'online',
<             'ga', 'co', 'cc', 'website'],
<         'digit_mapping': "abcdnfolmk",
<         'separator': '|'
47,50d39
< 
<         if config_nr == "11.37.0.0":
<             seed_str += "38"
< 
64c53
<             choices=["2.2.86.1", "2.2.97.0", "11.37.0.0"], default="2.2.86.1")
---
>             choices=["2.2.86.1", "2.2.97.0"], default="2.2.86.1")

dga_new.py is here, which base on the version implemented by baderj.