#!/usr/bin/env python3

from datetime import date
import time
import requests
import re

from dgacollection.Cryptolocker import Cryptolocker

# Faking the behavior of a DGA
print("Malware waiting...")
time.sleep(1)
print("Malware waking up")

# Retrieving domains generated by implementation of
# DGA from https://github.com/pchaigno/dga-collection
domains = (Cryptolocker.domains())
number_domains_generated = (len(Cryptolocker.domains()))

# Limiting sizes for demonstration
# in reality 500-50000 /day (Conficker)
number_domains_poc = 10

def get(domain):
    """Makes HTTP request to urls auto-generated

    Args:
        domain (string): possible c2-server url
    """
    url = 'https://' + domain
    try:
        r = requests.get(url)
        print(r.status_code)
        if r.status_code == 200:
            print(r.json())
            
    except requests.exceptions.ConnectionError as err:
        # Retrieve the errno of requests
        code_search = re.search("Errno ([-+]?[0-9]+)", err.args[0].reason.args[0])
        if code_search:
    	    code = int(code_search.group(1))
        # errno == -3 -> NXDOMAIN
        if (code == -3 or code == -2): 
            print("NXDOMAIN for " + domain)
        # errno != 3 -> the domain has been resolved
        # this is the C2-server
        else :
            print("Received response from c2-server (" + domain + ")")

for domain in range (number_domains_poc) :
    dga_domain = domains[domain]
    get(dga_domain)
    time.sleep(1)

# keep the container alive
while True:
    time.sleep(10)
#!/usr/bin/env python3

from datetime import date
import time
import requests
import re

from dgacollection.Cryptolocker import Cryptolocker

# Faking the behavior of a DGA
print("Malware waiting...")
time.sleep(1)
print("Malware waking up")

# Retrieving domains generated by implementation of
# DGA from https://github.com/pchaigno/dga-collection
domains = (Cryptolocker.domains())
number_domains_generated = (len(Cryptolocker.domains()))

# Limiting sizes for demonstration
# in reality 500-50000 /day (Conficker)
number_domains_poc = 10

def get(domain):
    """Makes HTTP request to urls auto-generated

    Args:
        domain (string): possible c2-server url
    """
    url = 'https://' + domain
    try:
        r = requests.get(url)
        print(r.status_code)
        if r.status_code == 200:
            print(r.json())
            
    except requests.exceptions.ConnectionError as err:
        # Retrieve the errno of requests
        code_search = re.search("Errno ([-+]?[0-9]+)", err.args[0].reason.args[0])
        if code_search:
    	    code = int(code_search.group(1))
        # errno == -3 -> NXDOMAIN
        if (code == -3 or code == -2): 
            print("NXDOMAIN for " + domain)
        # errno != 3 -> the domain has been resolved
        # this is the C2-server
        else :
            print("Received response from c2-server (" + domain + ")")

for domain in range (number_domains_poc) :
    dga_domain = domains[domain]
    get(dga_domain)
    time.sleep(1)

# keep the container alive
while True:
    time.sleep(10)
#!/usr/bin/env python3 # Faking the behavior of a DGA # Retrieving domains generated by implementation of # DGA from https://github.com/pchaigno/dga-collection # Limiting sizes for demonstration # in reality 500-50000 /day (Conficker) Makes HTTP request to urls auto-generated      Args:         domain (string): possible c2-server url # Retrieve the errno of requests # errno == -3 -> NXDOMAIN # errno != 3 -> the domain has been resolved # this is the C2-server # keep the container alive