From VT：2 new seeds of Murofet

[suqitian]

• MD5 f9c7354cd1cddac87e23783369af585c

• VT analysis

• Domains on 2018-01-29

  aouotztjyhqfyte.com
  aouotztjyhqfyte.org
  edsvmmkxelwws.biz
  edsvmmkxelwws.info
  hsmpxjllqdrqjymp.biz
  hsmpxjllqdrqjymp.info
  idqitwnirrmjrndn.com
  idqitwnirrmjrndn.net
  inlomnhpstizqonm.com
  inlomnhpstizqonm.net
  iofhsqfrtmtzskps.com
  iofhsqfrtmtzskps.info
  kffownxzwvozvel.com
  kffownxzwvozvel.org
  kgjtxvnrxwpxxekw.net
  kgjtxvnrxwpxxekw.org
  kkqzijwkpqphsq.net
  kkqzijwkpqphsq.org
  kqynjnvlqonocuv.com
  kqynjnvlqonocuv.net
  ...

[suqitian]

• Seed 0x78e4a3c0

• The number of domains 1020

• In order to cover all possibilities, need to generate 1020 domains per day (17 * second) % 0x3fc Range of second: [0, 59]

• Test

  $python  dga.py -k 0x78e4a3c0 -n 1020 -t `date +%s -d "2018-01-29 00:46:32"`
  ...
  aouotztjyhqfyte.org
  aouotztjyhqfyte.com
  unqrruogowuqpuri.info
  unqrruogowuqpuri.org
  kvkuiytvrurezqy.biz
  kvkuiytvrurezqy.com
  iofhsqfrtmtzskps.info
  iofhsqfrtmtzskps.com
  uiguvtexspoovip.net
  uiguvtexspoovip.biz
  vyrzisnlohqwesp.info
  vyrzisnlohqwesp.com
  kffownxzwvozvel.org
  kffownxzwvozvel.com
  lfkmbbqjnsofheju.biz
  lfkmbbqjnsofheju.org
  ...

[suqitian]

• Another MD5 5df9dc5fb4886a28133656b8c55fd65b
• Seed 0xed79a19c
• The number of domains 1020
• Test

  $ python dga_tdd.py -k 0xed79a19c -n 1020 -t `date +%s -d "2018-04-10 10:00:00"`
  wvvqzmrnlpmxwhly.biz
  wvvqzmrnlpmxwhly.com
  uzorqdovspvfvmvk.net
  uzorqdovspvfvmvk.org
  vsszqjkqrwumhrtu.info
  vsszqjkqrwumhrtu.biz
  pmnquslsesxohno.org
  pmnquslsesxohno.com
  qhzenflonnouslq.info
  qhzenflonnouslq.org
  xcsquocsngjmmmk.biz
  xcsquocsngjmmmk.com
  smuqierxxcqqzmn.info
  smuqierxxcqqzmn.com
  glmhxvfkptpxxri.net
  glmhxvfkptpxxri.biz
  wrtrjczcysxtmt.info
  wrtrjczcysxtmt.com
  npgocnmqoyvralq.org
  npgocnmqoyvralq.com
  lxugqomvmkpzool.biz
  lxugqomvmkpzool.org
  pkpnaqsmipqdwwh.net
  pkpnaqsmipqdwwh.com
  rivrovvhcnhhskrn.info
  rivrovvhcnhhskrn.biz
  osdqwstqvihvxvv.net
  osdqwstqvihvxvv.org
  tmquwhkklmnqortx.info
  tmquwhkklmnqortx.com
  llromlolzugnzxs.biz
  llromlolzugnzxs.com
  ...