API tools faq
paste
Advertisement
MalwareMustDie

#MalwareMustDie - UPDATE: Tango status of RunForrestRUn Case

MalwareMustDie
Aug 6th, 2013
1,505
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 10.08 KB | None | 0 0
raw download clone embed print report
  1. # Tango Status of the RunForrestRun RU DGA
  2. # Case: http://malwaremustdie.blogspot.jp/2013/07/the-come-back-of-ru-runforrestruns-dga.html
  3. # Latest status as per Tue Aug  6 14:06:15 JST 2013
  4.  
  5. # Summary;
  6.  
  7. 1. The initially spotted. as per blogged the four initially spotted 4 domains are still ups:
  8. bumggasfaoywfncc.ru,195.22.26.231,
  9. vvteeuevhpbpepfi.ru,91.233.244.102,
  10. ijxsncuprepwqzlt.ru,91.233.244.102,
  11. knuidyekzkyuhtpi.ru,91.233.244.102,
  12.  
  13. # Raised of 30 new registered domains:
  14.  
  15. 2. Previously spotted a sudden effort of registering 30 domains instantly:
  16.    Reported at : August 1, 2013 at 1:06 AM
  17.    here: http://malwaremustdie.blogspot.jp/2013/07/the-come-back-of-ru-runforrestruns-dga.html?showComment=1375344407647
  18.  
  19. // Tango re-requested and 25 domains was confirmed taken down successfully,
  20. // there are left over of 5 domains:
  21.  
  22. qhcplcuugevvyham.ru,,      ns1.otlard.com.      ns2.otlard.com.
  23. dueebwwdllfburag.ru,,      ns1.otlard.com.      ns2.otlard.com.
  24. pghnrmkoeoetfwsm.ru,,      ns1.otlard.com.      ns2.otlard.com.
  25. ctjbmgjudwisgshv.ru,,      ns1.otlard.com.      ns2.otlard.com.
  26. ogmjjmqdhlbyabzg.ru,,      ns1.otlard.com.      ns2.otlard.com.
  27.  
  28. // These 5 is under registry of NAUNET.RU:
  29. domain:        PGHNRMKOEOETFWSM.RU
  30. nserver:       ns1.otlard.com.
  31. nserver:       ns2.otlard.com.
  32. state:         REGISTERED, NOT DELEGATED, UNVERIFIED
  33. person:        Private Person
  34. registrar:     NAUNET-REG-RIPN
  35. admin-contact: https://client.naunet.ru/c/whoiscontact
  36. created:       2012.07.06
  37. paid-till:     2013.07.06
  38. free-date:     2013.08.06
  39. source:        TCI
  40. Last updated on 2013.08.06 08:46:36 MSK
  41.  
  42. 3. Surveillance list is as per below:
  43. kxfcnwlyyohascji.ru,,
  44. wjikjkybqouienfm.ru,,
  45. jwkynwfxjqdqqmji.ru,,
  46. vjnhblgryauqcpmr.ru,,
  47. iwoughjskqxnoury.ru,,
  48. tirdttcivfplnrds.ru,,
  49. gwtrhozqbvudulyl.ru,,
  50. siwafwlsbplqrxly.ru,,
  51. fvxordgblagqooqx.ru,,
  52. rhbyvkanoqokqyit.ru,,
  53. evdmudjenjokhgmz.ru,,
  54. phgunkwwcglepbdc.ru,,
  55. cuijmuljysivscwe.ru,,
  56. oglrzlxpvxfhgihb.ru,,
  57. bumggasfaoywfncc.ru,195.22.26.231,
  58. ngpormkfmmcfgysb.ru,,
  59. yrqwbnjqbnfhpbuu.ru,,
  60. lguktmilemdssbyx.ru,,
  61. xrvstpmjbtxnttxd.ru,,
  62. kfzhvfgdfixkfdrr.ru,,
  63. wqbrmmqhlkusiixa.ru,,
  64. jfegifyhkbjxfflc.ru,,
  65. uqfnewvxvyvsrxuk.ru,,
  66. hejcagnpfrpnqefc.ru,,
  67. tqkkpnnamkpqnyym.ru,,
  68. genyzeyokjwxykzm.ru,,
  69. spphczekzysdypqb.ru,,
  70. fdsvrfljfaskbylv.ru,,
  71. qptetotipsmswbqw.ru,,
  72. ddxrlumbiwovldwg.ru,,
  73. poyalyqorovwqves.ru,,
  74. ntppvruxnkdjhvbh.ru,,
  75. zgsxmhffvnizvxft.ru,,
  76. mtuloilstrcfoykq.ru,,
  77. yfxueilamhutmmnr.ru,,
  78. ksyiaulnbpgnxpjs.ru,,
  79. wfcsvebxgiynxlbc.ru,,
  80. jsehchxfgboukksb.ru,,
  81. vehpowijritygngg.ru,,
  82. isjdecxytkoiazad.ru,,
  83. uemmazcuvorvsadb.ru,,
  84. grnzukxvhqnjfana.ru,,
  85. sdqirxitzjgxxxhf.ru,,
  86. frswwkcwyjwmrorb.ru,,
  87. rdvfkzvdqxpufsep.ru,,
  88. eqxsyluecdcxpped.ru,,
  89. qdbewgrvhvwygvlo.ru,,
  90. cqcrrdgweomwshmp.ru,,
  91. ocfaopqtguzswofi.ru,,
  92. bpholidutrkjmtpp.ru,,
  93. nckwyplkpfqczmxl.ru,,
  94. znlfqprdgejpllxi.ru,,
  95. mbosgirfmfoygmhk.ru,,
  96. xnqbiapjqcpvvcqz.ru,,
  97. kbtpctegrcuillhc.ru,,
  98. wmuxxiagzhcieofr.ru,,
  99. jaymuwnpcjtqcwot.ru,,
  100. vmzukuabemehxwpw.ru,,
  101. hzbkqtgarqrmdlcx.ru,,
  102. qqafbwfwjrflbmdo.ru,,
  103. deeskswjfulkurjc.ru,,
  104. ppfbslcowvdivwmr.ru,,
  105. cejpdwxlftekbrch.ru,,
  106. npkxjvsffuotzmij.ru,,
  107. adnmvxwbyzjwvasg.ru,,
  108. moouumrwtvnetzfu.ru,,
  109. ybrdscaecknwugpu.ru,,
  110. lotqnwonxpgigjox.ru,,
  111. xawyilvvdurtcltc.ru,,
  112. joynyhkerylsfygl.ru,,
  113. vzzvoqbscqsnmrqr.ru,,
  114. indlredwgvungvsq.ru,,
  115. uyethhnsehcfqilz.ru,,
  116. hniitysuwprckvzs.ru,,
  117. syjqyvrpyohlexgj.ru,,
  118. fmmflppopijsipdr.ru,,
  119. ryonlorhvoekruec.ru,,
  120. emrbflbunrcqrjgk.ru,,
  121. qxsjdyodxeyyechp.ru,,
  122. dlwxvurpfeyqyqcj.ru,,
  123. oxxguneutbrhtsjx.ru,,
  124. blbwpvcyztrepfue.ru,,
  125. nwcenehdgqyxtssq.ru,,
  126. zjfndnhwdsrwephi.ru,,
  127. mwhbjgismatmjuji.ru,,
  128. yikkpeqinkedjnxs.ru,,
  129. kvmxjgblbhjgpjvw.ru,,
  130. wipgnmjxfgwttrlf.ru,,
  131. jvqtbrrbikxribjl.ru,,
  132. vhtdynyciknmkblg.ru,,
  133. tmlrjxvvrvkyxofn.ru,,
  134. gbogvuamqydsxcgz.ru,,
  135. smpovxvnxkelrgzt.ru,,
  136. eatdfntzfgqrprmj.ru,,
  137. qlulnseexvzpptcm.ru,,
  138. dzvyrlqebdcolbei.ru,,
  139. plzhfkuhkocvqwvx.ru,,
  140. cybxcikisigkmqtl.ru,,
  141. olegrpgtdxosnnkc.ru,,
  142. aygtmclwegxsmjid.ru,,
  143. mkjdkbwuxcnuxtqd.ru,,
  144. yvklttrmfvygrvwk.ru,,
  145. lknyzylpjzkasnmo.ru,,
  146. xvphlknpxewklsyd.ru,,
  147. kjsvlbwoxhcbtfpq.ru,,
  148. vvteeuevhpbpepfi.ru,91.233.244.102,
  149. ijxsncuprepwqzlt.ru,91.233.244.102,
  150. uuyavjatmoykgodf.ru,,
  151. hicqgipogsjulrgn.ru,,
  152. tudygcklurkthcmt.ru,,
  153. gihnijebfitftukm.ru,,
  154. rtivxqoindugifaf.ru,,
  155. ehmjatkmhnivwxdo.ru,,
  156. qtnrpbmfuierqstw.ru,,
  157. dhqgdpbdxrusdxcw.ru,,
  158. psroiljvwkqrnfqf.ru,,
  159. bhvdnklorkjcfppd.ru,,
  160. nswltcjxwwnbrljp.ru,,
  161. agabgtdhgsbspwsq.ru,,
  162. mrcjwchanjuilitl.ru,,
  163. yefscrehgfveysyc.ru,,
  164. wjvftsujnszcvevs.ru,,
  165. jwwtixcvymcflhob.ru,,
  166. vibeglyuxuzbkgbo.ru,,
  167. hwcrlxhvrevsnzwl.ru,,
  168. tifbsmujkhbvbkyj.ru,,
  169. gvhodonxvblrghch.ru,,
  170. shkwimusoizncvhx.ru,,
  171. fvllwtyeleporhen.ru,,
  172. rhotamrrectjqfto.ru,,
  173. duqhgptpqmsyyrqj.ru,,
  174. phtqmnbhcmyknyss.ru,,
  175. cuveztrnrgnshbgp.ru,,
  176. ogymeohrjxfscgfs.ru,,
  177. btacsqzlgctcxjei.ru,,
  178. mgdlwkvcgkygcqck.ru,,
  179. yretgeoqsvdnikar.ru,,
  180. lfihodgqdjmfqppt.ru,,
  181. xrjpymuxzutqaudg.ru,,
  182. kfnebggkwsjlxzbk.ru,,
  183. wqomqwbvtwiwejid.ru,,
  184. ierbdycqkclubnex.ru,,
  185. uqsiihfbyeotruuc.ru,,
  186. hewwcxblormskqae.ru,,
  187. tpxfuxwvnqcmekoi.ru,,
  188. gdbvudwhpnuwrdls.ru,,
  189. spdenojggmdrlixc.ru,,
  190. edgsojssutkqjbxg.ru,,
  191. qohaffgzdpnksohx.ru,,
  192. ddloyfnurjprfwnb.ru,,
  193. pomwopzpscwqxpfv.ru,,
  194. zfguwvhdmjlutvwo.ru,,
  195. mtiidqbknpskzasp.ru,,
  196. xflrjyyjswoatsoq.ru,,
  197. ksmfflbpefxgfdsv.ru,,
  198. wepnhoeeodiklyar.ru,,
  199. jsrcwahdmdarwmto.ru,,
  200. veukmrlhkghlqqjn.ru,,
  201. irwxwuybkwltqnhx.ru,,
  202. tezhfswbxfnnuhbd.ru,,
  203. grbwyglkgkieiybk.ru,,
  204. sdefwonjqnujdoxr.ru,,
  205. fqgtjwvcrkmuhkco.ru,,
  206. rdjcjrxljzaughvt.ru,,
  207. eqkplxtjjuhkbeqs.ru,,
  208. pcoyyxsfhsyysfme.ru,,
  209. cppmejjneikodxrc.ru,,
  210. ocsuqiqvvknfvcjp.ru,,
  211. bpujwsmplvftnqcx.ru,,
  212. nbxrjalwllvnbmfs.ru,,
  213. znyzszkdrxgnovuq.ru,,
  214. lbcpvpxigyferhws.ru,,
  215. xmexlajhysktwdqe.ru,,
  216. kahmnunornwrgpgb.ru,,
  217. wmiudbgrcvapriql.ru,,
  218. jzkitejvrxgkgpgi.ru,,
  219. ulnrpbudycxzdlkt.ru,,
  220. hyoflopkupjioiqq.ru,,
  221. tlrnhskrgijhwtlj.ru,,
  222. gytcnulxsxpsqkfn.ru,,
  223. skwkybckmywhrhbb.ru,,
  224. dernflilrdxmfnye.ru,,
  225. ppsvcvrcgkllplyn.ru,,
  226. bdvkpbuldslsapeb.ru,,
  227. npxsiiwpxqqiihmo.ru,,
  228. adbjjkquyyhyqknf.ru,,
  229. mocrafrewsdjztbj.ru,,
  230. yafzvancybuwmnno.ru,,
  231. lohnrnnpvvtxedfl.ru,,
  232. wakvnkyzkyietkdr.ru,,
  233. jnlkttkruqsdjqlx.ru,,
  234. vznrahwzgntmfcqk.ru,,
  235. inqgvoeohpcsfxmn.ru,,
  236. uyrorwlibbjeasoq.ru,,
  237. gmvdnpqbblixlgxj.ru,,
  238. sywleisrsstsqoic.ru,,
  239. fmacqvmqafqwmebl.ru,,
  240. rxbkqfydlnzopqrn.ru,,
  241. elfxqghdubihhsgd.ru,,
  242. qxggipnnfmnihkic.ru,,
  243. clkujrjqvexvbmoi.ru,,
  244. owldagkyzrkhqnjo.ru,,
  245. blorcdyiipxcwyxv.ru,,
  246. nwpykqeizraqthry.ru,,
  247. zisiiogqigzzqqeq.ru,,
  248. mvuvchtcxxibeubd.ru,,
  249. xixftoplsduqqorx.ru,,
  250. kvzstpqmeoxtcwko.ru,,
  251. whddmvrxufbkkoew.ru,,
  252. jveqgnmjxkocqifr.ru,,
  253. vhhzcvbegxbjsxke.ru,,
  254. iujniiokeyjbmerc.ru,,
  255. gacdiuwnhonuulpe.ru,,
  256. rmdlgyreitjsjkfq.ru,,
  257. ezfydrexncoidbus.ru,,
  258. qlihxnncwioxkdls.ru,,
  259. dyjvewshptsboygd.ru,,
  260. plmekaayiholtevt.ru,,
  261. cyosongjihugkjbg.ru,,
  262. nkrbvqxzfwicmhwb.ru,,
  263. axtopsbtntqnfdyk.ru,,
  264. mkwwclogcvgeekws.ru,,
  265. yvxfekhokspfuwqr.ru,,
  266. ljbvfrsvcevyfhor.ru,,
  267. xvcewyydwsmdgaju.ru,,
  268. jjgshrjdcynohyuk.ru,,
  269. vuhaojpwxgsxuitu.ru,,
  270. iiloishkjwvqldlq.ru,,
  271. uumwyzhctrwdsrdp.ru,,
  272. hiplksflttfkpsxn.ru,,
  273. ttqtkmthptxvwiku.ru,,
  274. fhuidtlqttqxgjvn.ru,,
  275. rtvqcdpbqxgwnrcn.ru,,
  276. ehyewyqydfpidbdp.ru,,
  277. qsbourrdxgxgwepy.ru,,
  278. dhedppigtpbwrmpc.ru,,
  279. osflhkaowydftniw.ru,,
  280. bgjzhlasdrwwnenj.ru,,
  281. nrkhysgoltauclop.ru,,
  282. zenquqdskekaudbe.ru,,
  283. mroeqjdaukskbgua.ru,,
  284. ydrngsmrdiiyvoiy.ru,,
  285. krtbityuhlewigfe.ru,,
  286. jwkpdxqbemsmclal.ru,,
  287. uinyjmxfqinkxbda.ru,,
  288. hvpmffxpfnlquqxo.ru,,
  289. tisubmfvqrgnloxr.ru,,
  290. gvujhzvjxwptrtdg.ru,,
  291. shxrsvasoncjnxpn.ru,,
  292. fuyfrockpfclxccd.ru,,
  293. qhcplcuugevvyham.ru,,
  294. dueebwwdllfburag.ru,,      ns1.otlard.com.
  295.       ns2.otlard.com.
  296. pghnrmkoeoetfwsm.ru,,      ns1.otlard.com.
  297.       ns2.otlard.com.
  298. ctjbmgjudwisgshv.ru,,
  299. ogmjjmqdhlbyabzg.ru,,      ns1.otlard.com.
  300.       ns2.otlard.com.
  301. atnwerhvttvbivra.ru,,
  302. mfqfrnqllqcrayiw.ru,,
  303. yrrnrgliojezjctg.ru,,
  304. lfvcngdbzjrzgyby.ru,,
  305. xqwkdyjydkggsppd.ru,,
  306. keabgwmpzqhpmlng.ru,,
  307. vqcicnuhtwhxmtjd.ru,,
  308. iefwvulgninlkoxe.ru,,
  309. upgghggmbusopaxv.ru,,
  310. hektxucstnbuncix.ru,,
  311. tplczomvebjmhsgk.ru,,
  312. gdoqznfilmtulxxv.ru,,
  313. ropypfmcqjjfdiel.ru,,
  314. edtmjcvfnfcbweed.ru,,
  315. qouubrmdxtgnnjvm.ru,,
  316. dcyjurmfwhgvyoio.ru,,
  317. pozrtgdmhvhvdscn.ru,,
  318. ccdifvomwhtynpay.ru,,
  319. nneplwlvlcojiegm.ru,,
  320. lsvdxjpwykxxvryd.ru,,
  321. xfymtpavzblzbknq.ru,,
  322. ksacasnubklrikdl.ru,,
  323. wedkgpdcxlrunbmu.ru,,
  324. jrfyaswntteouafv.ru,,
  325. veihxoqukuetxqbn.ru,,
  326. hrkusbnevtmyisab.ru,,
  327. tdndpphrtyniynvz.ru,,
  328. gqortbbbsnksxpmm.ru,,
  329. sdrzgpowhyckaogu.ru,,
  330. fqtooihtbhwdxskt.ru,,
  331. rcwwrqssqrrfpgvd.ru,,
  332. dpxkgybdgttbeyfh.ru,,
  333. pcbukgjlihpvehyu.ru,,
  334. cpdjalvpsvfgqtbd.ru,,
  335. obgrcxuqunmquthx.ru,,
  336. bpifbqdpzavdjljq.ru,,
  337. nbloiroucuvotnck.ru,,
  338. ymmwxgaimxgqtrdv.ru,,
  339. lapkpatjbkubfxeu.ru,,
  340. xmqspbcjfttkibbg.ru,,
  341. kauhrjmdqenmtyvk.ru,,
  342. wlvpilfxnxpdoujt.ru,,
  343. jzxdofqtnlusever.ru,,
  344. ulbnairmbptfscka.ru,,
  345. hyccqffkdslpbuue.ru,,
  346. tkfksqvkqdhspdsm.ru,,
  347. gyhxgveinbdufdnt.ru,,
  348. skkhxjykeyukyebl.ru,,
  349. exmubcrfgpaijgzx.ru,,
  350. opgsgmrejtyazcrf.ru,,
  351. bdjhtgqhggicwrmy.ru,,
  352. nolpsdqvivphcoew.ru,,
  353. zboxoswkbebgarsh.ru,,
  354. moplknnccyfkesaj.ru,,
  355. yasuaexybixmvnge.ru,,
  356. knuidyekzkyuhtpi.ru,91.233.244.102,
  357. wzvqmhzpppziurdl.ru,,
  358. jnyfopdfycjyfomx.ru,,
  359. vybofxkqmidtcnhq.ru,,
  360. imedqfzemirxjqhn.ru,,
  361. tyflwmgobjignmbd.ru,,
  362. gmjzqviddrqumknm.ru,,
  363. sxkiifqgzmsjvxzn.ru,,
  364. fmnvbcuebuoyhxgq.ru,,
  365. rxoebpmmwjgsphyp.ru,,
  366. elsskgujckxkdqry.ru,,
  367. pwtbsyitleslzngt.ru,,
  368. clxpvwfqexkciciu.ru,,
  369. owyxdqwgvlyndmwr.ru,,
  370. bkcnxdtvxcjpyobq.ru,,
  371. nwdvufzkpszkvxxk.ru,,
  372. zigfmudoxbqehljf.ru,,
  373. lvishxhsbgoyclva.ru,,
  374. xhlbffbmicnnxpsk.ru,,
  375. kvnoygvsciiyrnlp.ru,,
  376. whqxutzyuwvaijbq.ru,,
  377. jurlbjnqmycnjoat.ru,,
  378. vhutmessbhrhonso.ru,,
  379. huwiddttqzujegjk.ru,,
  380. tgzqyfhfekefmnuv.ru,,
  381. rlqglzqqhehmtryd.ru,,
  382. eystwwslgmwxzqsu.ru,,
  383. qlvcdbyuturxcusx.ru,,
  384. dywqzqyouieuojub.ru,,
  385. pkabphfegwhtnoug.ru,,
  386. bycojtqkhamhawoj.ru,,
  387. nkfxfqvofqbuhuuz.ru,,
  388. axhlltpcxcixsdhv.ru,,
  389. mjktxpzccvifevpc.ru,,
  390. yvlcjbweeheoixyj.ru,,
  391. ljoqjstmgdotqyll.ru,,
  392. wupyyjwqhozwdpcb.ru,,
  393. jitnlsxlmbtdzmwf.ru,,
  394. vuuurusnjxorennj.ru,,
  395. iiyjdtxigdyuyzcz.ru,,
  396. utzrdmsexiffrltv.ru,,
  397. hidifzbettjuadfh.ru,,
  398. steqvhuhrqsmynoh.ru,,
  399. fhifzexvhegcjtdx.ru,,
  400. rsjmnrjedkuvhwfs.ru,,
  401. ehmbrpusljbmykrn.ru,,
  402. qsojzcltslhstxnj.ru,,
  403. dgrxbomayxjhdike.ru,,
  404. ossgrsfecodjxjhy.ru,,
  405. bgwutpbwpbcrzthd.ru,,
  406. nrxcdfhydmlcnoay.ru,,
  407. zdbnzonswqhjphqh.ru,,
  408. mrcblkrgikgxxtwc.ru,,
  409. xdfjryydcfwvkvui.ru,,
  410. kqhxgmvevducviey.ru,,
  411.  
  412. ----
  413. #MalwareMustDie
  414. $ date
  415. Tue Aug  6 14:19:39 JST 2013
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!