Archivos del equipo atacante

DGA/charbot-dga.py

+import random
+from datetime import date
+import string
+
+NUM_REDIRECTORS = 4	# change for each experiment	
+
+fileIn = open('/home/usuario/Escritorio/payloads/charbot/top-200.csv', 'r')
+names = fileIn.readlines()
+fileIn.close()
+valid_names = []
+
+for name in names:
+	#remove numbers and domain
+	valid_names.append(name.strip().split(",")[1].split(".")[0])
+
+#remove duplicate
+valid_names = [i for n, i in enumerate(valid_names) if i not in valid_names[:n]]
+
+#generate date seed
+random.seed(str(date.today()).replace('-',''))
+#choose random domain names
+random_indices = random.sample(range(0,len(valid_names)), NUM_REDIRECTORS)
+
+valid_names_random = []
+
+for j in range(NUM_REDIRECTORS):
+	valid_names_random.append(valid_names[random_indices[j]])
+
+changed_names_random = []
+
+for n in range(NUM_REDIRECTORS):
+
+	if len(valid_names[random_indices[n]]) > 1:
+		#generate 2 random position to change
+		change_characters = random.sample(range(0,len(valid_names[random_indices[n]])), 2)
+		temp = list(valid_names_random[n]) 
+		#change 2 characters
+		temp[change_characters[0]] = random.choices(string.ascii_lowercase)[0]
+		temp[change_characters[1]] = random.choices(string.ascii_lowercase)[0]
+
+		changed_names_random.append(''.join(temp))
+		
+		#add TFG domain
+		changed_names_random[n] = changed_names_random[n] + ".malvado.org"
+
+	else:
+		temp = random.choices(string.ascii_lowercase)[0]
+		changed_names_random.append(''.join(temp))
+		changed_names_random[n] = changed_names_random[n] + ".malvado.org"
+
+	
+print (changed_names_random)
+
+

DGA/register-domains.sh

+#!/bin/bash
+
+names=$(python3 /home/usuario/Escritorio/payloads/charbot/charbot-dga.py)
+
+
+
+IFS="'"
+
+read -ra ADDR <<< "$names"
+
+redirectors=(192.168.2.11 192.168.2.12 192.168.2.13 192.168.2.14)
+
+for i in "${ADDR[@]}"; do   # access each element of array
+     if [ ${#i} -gt 2 ]; then
+        echo "$i"
+	echo "${redirectors[cont]}"
+  	touch nsupdate.txt
+	echo "server ns1.inter.infor.uva.es" > nsupdate.txt
+	echo "update add $i 86400 A ${redirectors[cont]}" >> nsupdate.txt
+	echo "send" >> nsupdate.txt
+        nsupdate nsupdate.txt
+
+        let cont=$cont+1
+    fi
+done
+
+rm nsupdate.txt

DGA/top-200.csv

+1,google.com
+2,youtube.com
+3,baidu.com
+4,facebook.com
+5,bilibili.com
+6,yahoo.com
+7,instagram.com
+8,qq.com
+9,wikipedia.org
+10,amazon.com
+11,twitter.com
+12,zhihu.com
+13,reddit.com
+14,whatsapp.com
+15,bing.com
+16,chaturbate.com
+17,google.com.hk
+18,taobao.com
+19,linkedin.com
+20,xvideos.com
+21,sina.com.cn
+22,weibo.com
+23,twitch.tv
+24,vk.com
+25,pornhub.com
+26,yandex.ru
+27,github.com
+28,sohu.com
+29,tmall.com
+30,163.com
+31,jd.com
+32,csdn.net
+33,microsoft.com
+34,live.com
+35,netflix.com
+36,tiktok.com
+37,fandom.com
+38,aliexpress.com
+39,yahoo.co.jp
+40,douban.com
+41,aparat.com
+42,xhamster.com
+43,t.co
+44,amazon.in
+45,paypal.com
+46,canva.com
+47,imdb.com
+48,apple.com
+49,ebay.com
+50,naver.com
+51,1688.com
+52,spankbang.com
+53,bongacams.com
+54,stackoverflow.com
+55,myshopify.com
+56,mail.ru
+57,zoom.us
+58,360.cn
+59,office.com
+60,xnxx.com
+61,duckduckgo.com
+62,quora.com
+63,hao123.com
+64,alipay.com
+65,google.co.in
+66,microsoftonline.com
+67,pinterest.com
+68,pikiran-rakyat.com
+69,pixiv.net
+70,discord.com
+71,telegram.org
+72,spotify.com
+73,twimg.com
+74,google.cn
+75,amazon.co.jp
+76,adobe.com
+77,msn.com
+78,tribunnews.com
+79,t.me
+80,etsy.com
+81,flipkart.com
+82,wordpress.com
+83,sogou.com
+84,indeed.com
+85,alibaba.com
+86,realsrv.com
+87,tencent.com
+88,mediafire.com
+89,booking.com
+90,nytimes.com
+91,youku.com
+92,bbc.com
+93,iqiyi.com
+94,ok.ru
+95,cnblogs.com
+96,hotstar.com
+97,3dmgame.com
+98,hupu.com
+99,imgur.com
+100,mega.nz
+101,bbc.co.uk
+102,tumblr.com
+103,doubleclick.net
+104,fc2.com
+105,researchgate.net
+106,roblox.com
+107,getadblock.com
+108,merdeka.com
+109,cnn.com
+110,nih.gov
+111,opensea.io
+112,amazonaws.com
+113,avito.ru
+114,fiverr.com
+115,coinmarketcap.com
+116,gearbest.com
+117,so.com
+118,jianshu.com
+119,aliyun.com
+120,varzesh3.com
+121,onlyfans.com
+122,medium.com
+123,savefrom.net
+124,freepik.com
+125,rakuten.co.jp
+126,espn.com
+127,detik.com
+128,walmart.com
+129,tradingview.com
+130,kompas.com
+131,patreon.com
+132,binance.com
+133,primevideo.com
+134,mihoyo.com
+135,smzdm.com
+136,animeflv.net
+137,instructure.com
+138,albawabhnews.com
+139,ali213.net
+140,amazon.co.uk
+141,ifeng.com
+142,google.fr
+143,udemy.com
+144,ilovepdf.com
+145,nga.cn
+146,suara.com
+147,zillow.com
+148,deviantart.com
+149,ltn.com.tw
+150,vimeo.com
+151,youdao.com
+152,bet365.com
+153,digikala.com
+154,w3schools.com
+155,kumparan.com
+156,dailymail.co.uk
+157,amazon.it
+158,grammarly.com
+159,cctv.com
+160,yandex.com
+161,zhibo8.cc
+162,amazon.de
+163,tistory.com
+164,nicovideo.jp
+165,googlevideo.com
+166,shopify.com
+167,bet9ja.com
+168,theguardian.com
+169,dropbox.com
+170,telewebion.com
+171,amazon.ca
+172,chase.com
+173,gogoanime.sk
+174,dmm.co.jp
+175,nyaa.si
+176,dcinside.com
+177,google.co.jp
+178,y2mate.com
+179,google.ru
+180,nhentai.net
+181,weather.com
+182,marca.com
+183,daum.net
+184,xiaohongshu.com
+185,metropoles.com
+186,yts.mx
+187,steampowered.com
+188,linktr.ee
+189,cricbuzz.com
+190,speedtest.net
+191,blogger.com
+192,crunchyroll.com
+193,google.com.tw
+194,archive.org
+195,craigslist.org
+196,sxyprn.com
+197,amazon.es
+198,ozon.ru
+199,douyu.com
+200,google.ca