Susp DGA from PDNS: A fix length of 16, mix a-z and 0-9, tlds: [org, ru, cn, net, info, biz]

[suqitian]

• MD5
  55c447191d9566c7442e25c4caf0d2fe
• These suspicious domains had been noticed for a long time from PDNS system, but until weeks ago, we found a new method to map these domains to the target MD5. Domains sampled on Aug 07, 2016:
  53ptxfec6a4mwbrl.org
  ou16nagv4pashauc.ru
  cav36gi2q7sw1quk.cn
  vnbbj9a2udxpfq2c.cn
  fqtk3dzc23momnpg.org
  4w30kxhvkfel0oup.net
  9n78kfujyzmip0qv.info
  w2ot29dbfzg6keue.ru
  d9tan26jpjpz9snt.cn
  guf7vdg5eutsacyj.ru
  l1sfcoafyl7x1gkr.biz
  jq1i45ll407n59fi.info
  p5oaqfyxb94yig2t.org
  9q02paxvmei1v6sp.ru
  jayzvrpixxlc58bc.info
  eseu24pzdd5f72vv.biz
  dcydfwpx6g5to34s.cn
  ydd3i2lh6afrfmw1.ru
• Malware sample[ 55c447191d9566c7442e25c4caf0d2fe] DNS queries, very similar to those domains in the list above.
  0aa05rcmqxnz7vzj.net
  29cqdf6obnq462yv.com
  2s3txyhr1ptozde7.info
  5qip6brukxyf9lhk.ru
  7vzlqhsisdgk1diw.net
  8ccl6qveudd642rq.ru
  etkxskxjy8sn4niz.ru
  gkczbuwjza2s1khf.net
  nhamoigj5jd1qyn4.cn
  o47xa659ueqorz57.org
  p7rmkau94thlq1tb.cn
  qowhi81jvoid4j0m.biz
  tjklzgosi2xivjs4.biz
  zinna4ltt9yx9bih.com
  0aa05rcmqxnz7vzj.net
  29cqdf6obnq462yv.com
  2s3txyhr1ptozde7.info
  5qip6brukxyf9lhk.ru
  7vzlqhsisdgk1diw.net
  8ccl6qveudd642rq.ru
  dahs7d52v40cyxgi.info
  etkxskxjy8sn4niz.ru
  gkczbuwjza2s1khf.net
  gnjvn08gxgd2u6dh.info
  nhamoigj5jd1qyn4.cn
  o47xa659ueqorz57.org
  p7rmkau94thlq1tb.cn
  qowhi81jvoid4j0m.biz
• So, really looking forward to reverse engineer this binary and feed back the implementation of DGA, then we can filter out these malicious domains in PDNS system.

[suqitian]

Some details about this malware:
https://blog.malwarebytes.com/threat-analysis/2015/06/unusual-exploit-kit-targets-chinese-users-part-2/

Run this sample in my virtualbox, it drop a file named 4VJzegtSr.exe into path C:\Windows\system\JkLtFzICS.
Double click 4VJzegtSr.exe, wait for a minutes, hundreds of domains will be seen in wireshark.

[suqitian]

The DGA of Chinad
1000 domains per day

Test:

$ date +%s -d "2016-08-7 12:00:00"  
1470542400
$ python dga.py -t 1470542400 -n 1000 -l 16 | less
...
53ptxfec6a4mwbrl.org
gyzn61atzscg0uik.info
9j5k16z7x0zdh1ro.net
...
ou16nagv4pashauc.ru
neblb4lwt5jknbo4.com
uknvzqus9y71mo1y.info
...

The output are well-matched to those domains which observed from PDNS on Aug 07, 2016.
And file dga.py is here.