360netlab / DGA

Suspicious DGA from PDNS and Sandbox.
MIT License
182 stars 35 forks source link

From VT: A length of 9-14, a-z, tlds: [com], the third new seed of FakeAV? #18

Closed suqitian closed 7 years ago

suqitian commented 8 years ago

21d181a638846e6aab83917a4b030d27

suqitian commented 8 years ago

All domains, 70 in total. bakagunaxepo.com bipuwyqojivu.com bogekizase.com boqerorune.com cinuherijugeg.com civivicuqekexo.com demoziqut.com dipolakiri.com dokejecufinulo.com febysaholubaro.com fivulaxavys.com fopuvuwupode.com gafotulerilir.com gikekypowaqa.com gipupeceta.com hehyvixiru.com hemusyheduf.com hobolamitajy.com jetuqaroxos.com jocojihuc.com jyxirafyhulora.com labicycosibuw.com laruryjuzycez.com ledimajezociw.com levulehup.com levysavasezo.com litypacuxava.com mohijyxazyby.com nigyruqyn.com nipoloquv.com pafozykavygaj.com pejozehywe.com pisowyxuwisin.com pomexyposenebi.com porozybaru.com putijucyvazym.com qojijixiwidaz.com qosifavede.com qotasifelaw.com quwenofoki.com rabuqibareme.com rijucyvybumyka.com sivycaqilugoq.com sumatevebat.com suzehebaq.com syqivolurypugi.com sysigicigisav.com tedahokuj.com tibumuqel.com tyqonelaresuz.com vonygulyxiqo.com vyxutoxotynif.com waciroqohuli.com witywypihag.com wudicofez.com wybuzyrywovaj.com wycecikodovi.com wydajufacysyd.com wywazediwo.com xecuhuziqys.com xegunider.com xipifexegybozi.com xoxakipowu.com xucysasowebaty.com xuryfacaqy.com zarapetahuryp.com zaryhocypase.com zificefydyn.com zyzanewodojyx.com

suqitian commented 8 years ago

24 malware samples which have the same behaviours. 21d181a638846e6aab83917a4b030d27 2535075dcca40230e288164100c685c6 7c39361ae11a410645fa8148dfce924e a90679f188b4056763dd26902472d072 1c89a83251c18172717b521c41e36561 6e5e6ff28d1ebed21ac2019f264ae8ad a2614e17113960e480a0982ce58fdafc b86b23151247fa1a840ef80ef01d6a00 bfe0fa3cd889f3546128958df3a6e8a1 e87dff6ea0a2c8480abd88f9582fd1e2 2b0c3c5de3237b23cb1bd35009e6095b 30612090d3828529a779a6100641b346 3604e34c69ed8da3236df1c1c0336c96 4176ea66ad8bbf37cb79796272d04508 601b6615acc7928fffcf6a44c3ce9ac8 76dd6c59feae5c8458ea4f496a30594d 8740d5d2f094f7c088afec5d2bcddeef b19ba380e7ace201c166261bf6f5360d bc4ee80abbe5e0cacd4b72deb2528cf1 cb4ce5675805898c859eb9236e4dd6cf d815ba1ac0175f04741ba036841cde9e e72d5f26392f2f7c23ae1a63783ab7d1 00f28fceebcd26c0efd3546fccedb598 41700e3fdf24e755ae242b4d65126f9e

suqitian commented 7 years ago

Not DGA.