2

Where i can get DGA (Domain Generation Algorithm) based malware files for analysis? And,Can I get malware family names which is using Domain Generation Algorithm?

  • 2
    I don't think anyone makes a special category for DGA-based malware so you'll just have to find them yourself among other samples. Otherwise such type of question is too broad to be answered properly. – Igor Skochinsky Apr 3 '17 at 18:44
  • 2
    I tend to disagree with closing this question. There are only dozens of DGA-centric malware families, and only a handful of well-known ones. This question, IMHO, can be cleanly answered and provides value to users. I therefore nominate it to reopening. – NirIzr Apr 3 '17 at 21:07
  • 1
    you can use botconf.eu/wp-content/uploads/2015/12/… is a reasonable start – broadway Apr 4 '17 at 4:59
6

I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a reasonable number of different samples yourself.

  1. There is Johannes Bader's github repository which features several reimplementations of DGAs found in malware, along with detailed write-ups and reference hashes.

  2. If you are looking for some more background (more than in my BotConf talk) check out our USENIX paper, we listed many of the primary characteristics for a selection DGAs.

  3. I also run DGArchive - the referenced database of algorithmically generated domains (69 DGAs, 617 seeds, 63,699,402 unique domains). Other similar databases are John Bambenek's OSINT feed and 360.cn Netlab's DGA project.

  4. I will likely provide tags on samples (such as "c2_dga" or similar) on the corpus of my current pet project malpedia.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.