Where i can get DGA (Domain Generation Algorithm) based malware files for analysis? And,Can I get malware family names which is using Domain Generation Algorithm?
-
2I don't think anyone makes a special category for DGA-based malware so you'll just have to find them yourself among other samples. Otherwise such type of question is too broad to be answered properly.– Igor Skochinsky ♦Apr 3, 2017 at 18:44
-
2I tend to disagree with closing this question. There are only dozens of DGA-centric malware families, and only a handful of well-known ones. This question, IMHO, can be cleanly answered and provides value to users. I therefore nominate it to reopening.– NirIzrApr 3, 2017 at 21:07
-
1you can use botconf.eu/wp-content/uploads/2015/12/… is a reasonable start– broadwayApr 4, 2017 at 4:59
Add a comment
|
1 Answer
I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a reasonable number of different samples yourself.
There is Johannes Bader's github repository which features several reimplementations of DGAs found in malware, along with detailed write-ups and reference hashes.
If you are looking for some more background (more than in my BotConf talk) check out our USENIX paper, we listed many of the primary characteristics for a selection DGAs.
I also run DGArchive - the referenced database of algorithmically generated domains (69 DGAs, 617 seeds, 63,699,402 unique domains). Other similar databases are John Bambenek's OSINT feed and 360.cn Netlab's DGA project.
I will likely provide tags on samples (such as "c2_dga" or similar) on the corpus of my current pet project malpedia.
