The DGA of Enviserv

[suqitian]

• MD5
  4328048f82811146c0fd9e18faff7155

• VT analysis

• Domains generated on 2019/08/06
  fe28753777.com
  9dcd84b090.net
  02261e64b3.org
  20c97d8c3d.info
  5ae4d66001.biz
  e3bea872ae.in
  150d064880.com
  34636b0b94.net
  4e8414394d.org
  d84a6a7a28.info
  ...

• The threat report from Microsoft.

[suqitian]

• Thanks to my colleague Jinye for helping reverse engineer binary file.

• TLDs
  ['com', 'net', 'org', 'info', 'biz', 'in']

• The number of domains
  500 in total

• Test

$ python dga.py -n 500
fe28753777.com
9dcd84b090.net
02261e64b3.org
20c97d8c3d.info
5ae4d66001.biz
e3bea872ae.in
150d064880.com
34636b0b94.net
4e8414394d.org
d84a6a7a28.info
......

The output are well-matched to the domains generated by sample.
dga.py is here.