Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

From VT: A length of 9-14, a-z, tlds: [com], the third new seed of FakeAV? #18

Closed
suqitian opened this issue Sep 21, 2016 · 3 comments
Closed

Comments

@suqitian
Copy link
Member

suqitian commented Sep 21, 2016

  • MD5

21d181a638846e6aab83917a4b030d27

  • Domain
    See the list of all domains below.
  • Time independent DGA
@suqitian
Copy link
Member Author

All domains, 70 in total.
bakagunaxepo.com
bipuwyqojivu.com
bogekizase.com
boqerorune.com
cinuherijugeg.com
civivicuqekexo.com
demoziqut.com
dipolakiri.com
dokejecufinulo.com
febysaholubaro.com
fivulaxavys.com
fopuvuwupode.com
gafotulerilir.com
gikekypowaqa.com
gipupeceta.com
hehyvixiru.com
hemusyheduf.com
hobolamitajy.com
jetuqaroxos.com
jocojihuc.com
jyxirafyhulora.com
labicycosibuw.com
laruryjuzycez.com
ledimajezociw.com
levulehup.com
levysavasezo.com
litypacuxava.com
mohijyxazyby.com
nigyruqyn.com
nipoloquv.com
pafozykavygaj.com
pejozehywe.com
pisowyxuwisin.com
pomexyposenebi.com
porozybaru.com
putijucyvazym.com
qojijixiwidaz.com
qosifavede.com
qotasifelaw.com
quwenofoki.com
rabuqibareme.com
rijucyvybumyka.com
sivycaqilugoq.com
sumatevebat.com
suzehebaq.com
syqivolurypugi.com
sysigicigisav.com
tedahokuj.com
tibumuqel.com
tyqonelaresuz.com
vonygulyxiqo.com
vyxutoxotynif.com
waciroqohuli.com
witywypihag.com
wudicofez.com
wybuzyrywovaj.com
wycecikodovi.com
wydajufacysyd.com
wywazediwo.com
xecuhuziqys.com
xegunider.com
xipifexegybozi.com
xoxakipowu.com
xucysasowebaty.com
xuryfacaqy.com
zarapetahuryp.com
zaryhocypase.com
zificefydyn.com
zyzanewodojyx.com

@suqitian
Copy link
Member Author

24 malware samples which have the same behaviours.
21d181a638846e6aab83917a4b030d27
2535075dcca40230e288164100c685c6
7c39361ae11a410645fa8148dfce924e
a90679f188b4056763dd26902472d072
1c89a83251c18172717b521c41e36561
6e5e6ff28d1ebed21ac2019f264ae8ad
a2614e17113960e480a0982ce58fdafc
b86b23151247fa1a840ef80ef01d6a00
bfe0fa3cd889f3546128958df3a6e8a1
e87dff6ea0a2c8480abd88f9582fd1e2
2b0c3c5de3237b23cb1bd35009e6095b
30612090d3828529a779a6100641b346
3604e34c69ed8da3236df1c1c0336c96
4176ea66ad8bbf37cb79796272d04508
601b6615acc7928fffcf6a44c3ce9ac8
76dd6c59feae5c8458ea4f496a30594d
8740d5d2f094f7c088afec5d2bcddeef
b19ba380e7ace201c166261bf6f5360d
bc4ee80abbe5e0cacd4b72deb2528cf1
cb4ce5675805898c859eb9236e4dd6cf
d815ba1ac0175f04741ba036841cde9e
e72d5f26392f2f7c23ae1a63783ab7d1
00f28fceebcd26c0efd3546fccedb598
41700e3fdf24e755ae242b4d65126f9e

@suqitian suqitian changed the title From VT: A length of 9-14, a-z, tlds: [com], a new seed of FakeAV? From VT: A length of 9-14, a-z, tlds: [com], the third new seed of FakeAV? Sep 21, 2016
@suqitian
Copy link
Member Author

Not DGA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant