From PDNS: A fix length of 16, hexadecimal notation, tlds:[com]

suqitian commented 6 years ago

A suspicious DGA cluster from PDNS

Domains on 2018-06-18

32994a8c5b77d4ba.com
3fa34e473d565b43.com
4ad2453b3d16477b.com
4e7a6af91ba29a22.com
7387c88fc2feff5b.com
8e3746b91711cf9d.com
97e36cef4a6221be.com
9c90f99c44a8e61f.com
b91076d16f4ea33c.com
ba6ab0a5d7a4e503.com
f48c01a836b4c3de.com

suqitian commented 6 years ago

Found a suspicious sample from sandbox, but the time is 2011
MD5 4ac190bf7d40d3b49a791ddaa0d5fe0b

Domains on 2011-10-24

5154CD1AB49AA9A2.com
B64EB654286C9D6C.com
9599BDB2E47B332B.com
79AAC5F66C8B55F3.com
D3A2EF7E7CDE45A7.com
nxdomain.saferesolve.com
78D41CA2C439A8F1.com
41F45E7162BCE883.com
4A8A2212A4441495.com
71CDCA31E2949BE3.com
DB57E3BBF6C7AFB6.com
A954A3F76E47A952.com
country.saferesolve.com
D18BC959329217A3.com
163E677A74CE7C2C.com
block.saferesolve.com
6E7EDA7D7AB4FDDC.com
73F68B7A7416EDE7.com
EBED2D2AD45ADAD7.com
465338DB3671A68C.com
D3D51D16AC3AAAA7.com
EF94C8DB369129DF.com
B3153FCB167F2A66.com
2D8CDB1DBAB6195B.com
C9B9CC8D9A997393.com
C66BFB858AF7D78C.com
2D9E2B4C18563C5B.com
E63DAD99B25B7BCC.com
12ACF52EDCEA5925.com
513D9A27CE347BA2.com
558D324C18641AAB.com
A254AFE4485FA944.com
FB24AA3FFE5449F6.com
6B88E5B6ECCB11D7.com
BA6C3B31E276D874.com
5B4EAE4B165C9DB6.com
613376E74EED66C2.com
6BED646346C8DAD7.com
2AAE194912325C55.com
8B8A562EDCAC1417.com
C14B7E858AFD9682.com
ABF1CE766C9CE357.com
2B5D675428CEBA56.com
61BA112BD62274C3.com

suqitian commented 6 years ago

Today, 2018/08/27, I run this sample in our sandbox and capture some domains, maybe it is a TDD DGA.

6D226FFB76DF44DA.com
322F2653264C5E64.com
17FE3652246CFC2F.com
8D5C5219B2A4B81A.com
BDE97BDA34F7D27B.com
6F244D9AB49B48DE.com
4C12C16D5A822598.com
F3DDC8FD7A91BBE7.com
92392DD52A5B7224.com
25F14F62449EE24B.com
9EDD915D3A22BB3D.com
DFA12AD72E5542BF.com
56AE4DDC389B5CAD.com
5AEAC1BAF483D5B5.com
711A4234E88434E2.com
block.saferesolve.com
71C27C756AF884E3.com
E7FA2331E246F4CF.com
BAD71D9BB63BAE75.com
3D3FCC32E4987F7A.com
19D6B3EB5667AD33.com
15C2928A9425852B.com
7EA39CE54A3947FD.com
B2D4DDA4C8BBA965.com
5CC8E44A14C891B9.com
C2971DF9723B2E85.com
722A6EB2E4DD54E4.com
332427878E4F4866.com
1E5D41BBF683BA3C.com
917D71FE7CE3FA22.com
9AE65E3BF6BCCC35.com
A2967D3DFAFA2C45.com
69B4537972A668D3.com
F391F93EFCF223E7.com
261B9579722A374C.com
E4B31AFE7C3566C9.com
DC79F67F7EECF3B8.com
C8C5C2BAF4858B91.com
7A2FA69FBE4D5FF4.com
BFD1DACF1EB5A37F.com
5FD351DB36A3A6BF.com
6121A21EBC4443C2.com
297DC8F66C91FB52.com
2615516B56A22A4C.com
BAD178A4C8F1A275.com
1CED8A16AC14DB39.com
49D66D6B56DAAC93.com
5E4B4897AE9196BC.com
425F51FE7CA3BE84.com
B94F14572E289E72.com
1C9C962CD82C3939.com
F8B7FCEA54F96FF1.com
6CCC56AFDEAD98D9.com
BDFD28E34651FA7B.com
3896226A54442C71.com
E2B38916AC1267C5.com
1EC734BAF4698E3D.com
FF2C8EA6CC1D59FE.com
2E97A9CB16532F5D.com
CE691F74683ED29C.com

360netlab / DGA

From PDNS: A fix length of 16, hexadecimal notation, tlds:[com] #46