The DGA of Simda/Shiz

Only when I had already finished the DGA of Simda/Shiz, I noticed that DGArchive and Abuse.ch analysed Simda’s DGA before me. All this entry contributes are two additional seeds.

The DGA

The DGA is pretty simple:

length = 7
tld = "com"
key = "1676d5775e05c50b46baa5579d4fc7"
base = 0x45AE94B2

consonants = "qwrtpsdfghjklzxcvbnmv"
vowels = "eyuioa"

step = 0
for m in key:
    step += ord(m)

for nr in range(1000):
    domain = ""
    base += step

    for i in range(length):
        index = int(base/(3+2*i))
        if i % 2 == 0:
            char = consonants[index % 20]
        else:
            char = vowels[index % 6]
        domain += char

    domain += "." + tld
    print(domain)

The length, top level domain, and the key vary from sample to sample. For the domain generation, only the sum of the key’s character matter, the key itself is irrelevant.

The Seeds

I found five different sets of seeds + one on virustracker:

I have not had access to a sample for the fourth and sixth seed, but found the key sum to be 2038 by brute forcing. Here is a Python script of the DGA that contains these five seeds.

Samples on Malwr.com

The following table lists samples from malwr.com that use the DGA of Simda/Shiz:

(g): generic, ?: not scanned, (c): clean