Merge pull request #1 from zGreg/master

Added pizd DGA
baderj · Sep 27, 2017 · fd1c500 · fd1c500
2 parents 1a315dc + e4b2ead
commit fd1c500
Show file tree

Hide file tree

Showing 3 changed files with 430 additions and 1 deletion.
diff --git a/README.md b/README.md
@@ -1,10 +1,11 @@
 # Domain Generation Algorithms 
-Some results of my DGA reversing efforts
+Johannes Bacher's reversing efforts 
 
 ## Overview
 
 Subfolder | Malware Family | Alias | Write-Up
 --------- | -------------- | ----- | ----------
+pizd      |   ??           |       | [link] (https://blog.avast.com/2013/06/18/your-facebook-connection-is-now-secured/)
 newgoz    | newGOZ         | Gameover Zeus, Peer-to-Peer Zeus |   [link](https://johannesbader.ch/2014/12/the-dga-of-newgoz/)
 ramnit    | Ramnit         | | [link](https://johannesbader.ch/2014/12/the-dga-of-ramnit/)
 shiotob   | Shiotob        | Urlzone, Bebloh | [link](https://johannesbader.ch/2015/01/the-dga-of-shiotob/)

diff --git a/pizd/examples.txt b/pizd/examples.txt
@@ -0,0 +1 @@
+['cleanlength.net', 'chargeneither.net', 'cleanneither.net', 'chiefleader.net', 'clearleader.net', 'chiefneedle.net', 'clearneedle.net', 'chieflength.net', 'clearlength.net', 'chiefneither.net', 'clearneither.net', 'considerleader.net', 'crowdleader.net', 'considerneedle.net', 'crowdneedle.net', 'considerlength.net', 'crowdlength.net', 'considerneither.net', 'crowdneither.net', 'containleader.net', 'daughterleader.net', 'containneedle.net', 'daughterneedle.net', 'containlength.net', 'daughterlength.net', 'containneither.net', 'daughterneither.net', 'chooseleader.net', 'collegeleader.net', 'chooseneedle.net', 'collegeneedle.net', 'chooselength.net', 'collegelength.net', 'chooseneither.net', 'collegeneither.net', 'cigaretteleader.net', 'companyleader.net', 'cigaretteneedle.net', 'companyneedle.net', 'cigarettelength.net', 'companylength.net', 'cigaretteneither.net', 'companyneither.net', 'cornerleader.net', 'delightleader.net', 'cornerneedle.net', 'delightneedle.net', 'cornerlength.net', 'delightlength.net', 'cornerneither.net', 'delightneither.net', 'countryleader.net', 'demandleader.net', 'countryneedle.net', 'demandneedle.net', 'countrylength.net', 'demandlength.net', 'countryneither.net', 'demandneither.net', 'chargemanner.net', 'cleanmanner.net', 'chargenumber.net', 'cleannumber.net', 'chargemaster.net', 'cleanmaster.net', 'chargeoclock.net', 'cleanoclock.net', 'chiefmanner.net', 'clearmanner.net', 'chiefnumber.net', 'clearnumber.net', 'chiefmaster.net', 'clearmaster.net', 'chiefoclock.net', 'clearoclock.net', 'considermanner.net', 'crowdmanner.net', 'considernumber.net', 'crowdnumber.net', 'considermaster.net', 'crowdmaster.net', 'consideroclock.net', 'crowdoclock.net', 'containmanner.net', 'daughtermanner.net', 'containnumber.net', 'daughternumber.net', 'containmaster.net', 'daughtermaster.net', 'containoclock.net', 'daughteroclock.net', 'choosemanner.net', 'collegemanner.net', 'choosenumber.net', 'collegenumber.net', 'choosemaster.net', 'collegemaster.net', 'chooseoclock.net', 'collegeoclock.net', 'cigarettemanner.net', 'companymanner.net', 'cigarettenumber.net', 'companynumber.net', 'cigarettemaster.net', 'companymaster.net', 'cigaretteoclock.net', 'companyoclock.net', 'cornermanner.net', 'delightmanner.net', 'cornernumber.net', 'delightnumber.net', 'cornermaster.net', 'delightmaster.net', 'corneroclock.net', 'delightoclock.net', 'countrymanner.net', 'demandmanner.net', 'countrynumber.net', 'demandnumber.net', 'countrymaster.net', 'demandmaster.net', 'countryoclock.net', 'demandoclock.net', 'chargestranger.net', 'cleanstranger.net', 'chargetravel.net', 'cleantravel.net', 'chargestreet.net', 'cleanstreet.net', 'chargetrust.net', 'cleantrust.net', 'chiefstranger.net', 'clearstranger.net', 'chieftravel.net', 'cleartravel.net', 'chiefstreet.net', 'clearstreet.net', 'chieftrust.net', 'cleartrust.net', 'considerstranger.net', 'crowdstranger.net', 'considertravel.net', 'crowdtravel.net', 'considerstreet.net', 'crowdstreet.net', 'considertrust.net', 'crowdtrust.net', 'containstranger.net', 'daughterstranger.net', 'containtravel.net', 'daughtertravel.net', 'containstreet.net', 'daughterstreet.net', 'containtrust.net', 'daughtertrust.net', 'choosestranger.net', 'collegestranger.net', 'choosetravel.net', 'collegetravel.net', 'choosestreet.net', 'collegestreet.net', 'choosetrust.net', 'collegetrust.net', 'cigarettestranger.net', 'companystranger.net', 'cigarettetravel.net', 'companytravel.net', 'cigarettestreet.net', 'companystreet.net', 'cigarettetrust.net', 'companytrust.net', 'cornerstranger.net', 'delightstranger.net', 'cornertravel.net', 'delighttravel.net', 'cornerstreet.net', 'delightstreet.net', 'cornertrust.net', 'delighttrust.net', 'countrystranger.net', 'demandstranger.net', 'countrytravel.net', 'demandtravel.net', 'countrystreet.net', 'demandstreet.net', 'countrytrust.net', 'demandtrust.net', 'chargesucceed.net', 'cleansucceed.net', 'chargevalley.net', 'cleanvalley.net', 'chargesudden.net', 'cleansudden.net', 'chargevarious.net', 'cleanvarious.net', 'chiefsucceed.net', 'clearsucceed.net', 'chiefvalley.net', 'clearvalley.net', 'chiefsudden.net', 'clearsudden.net', 'chiefvarious.net', 'clearvarious.net', 'considersucceed.net', 'crowdsucceed.net', 'considervalley.net', 'crowdvalley.net', 'considersudden.net', 'crowdsudden.net', 'considervarious.net', 'crowdvarious.net', 'containsucceed.net', 'daughtersucceed.net', 'containvalley.net', 'daughtervalley.net', 'containsudden.net', 'daughtersudden.net', 'containvarious.net', 'daughtervarious.net', 'choosesucceed.net', 'collegesucceed.net', 'choosevalley.net', 'collegevalley.net', 'choosesudden.net', 'collegesudden.net', 'choosevarious.net', 'collegevarious.net', 'cigarettesucceed.net', 'companysucceed.net', 'cigarettevalley.net', 'companyvalley.net', 'cigarettesudden.net', 'companysudden.net', 'cigarettevarious.net', 'companyvarious.net', 'cornersucceed.net', 'delightsucceed.net', 'cornervalley.net', 'delightvalley.net', 'cornersudden.net', 'delightsudden.net', 'cornervarious.net', 'delightvarious.net', 'countrysucceed.net', 'demandsucceed.net', 'countryvalley.net', 'demandvalley.net', 'countrysudden.net', 'demandsudden.net', 'countryvarious.net', 'demandvarious.net', 'deviceleader.net', 'distantleader.net', 'deviceneedle.net', 'distantneedle.net', 'devicelength.net', 'distantlength.net', 'deviceneither.net', 'distantneither.net', 'differenceleader.net', 'divideleader.net', 'differenceneedle.net', 'divideneedle.net', 'differencelength.net', 'dividelength.net', 'differenceneither.net', 'divideneither.net', 'duringleader.net', 'enoughleader.net', 'duringneedle.net', 'enoughneedle.net', 'duringlength.net', 'enoughlength.net', 'duringneither.net', 'enoughneither.net', 'earlyleader.net', 'enterleader.net', 'earlyneedle.net', 'enterneedle.net', 'earlylength.net', 'enterlength.net', 'earlyneither.net', 'enterneither.net', 'dinnerleader.net', 'doubleleader.net', 'dinnerneedle.net', 'doubleneedle.net', 'dinnerlength.net', 'doublelength.net', 'dinnerneither.net', 'doubleneither.net', 'directleader.net', 'doubtleader.net', 'directneedle.net', 'doubtneedle.net', 'directlength.net', 'doubtlength.net', 'directneither.net', 'doubtneither.net', 'eitherleader.net']