#DhiaLite- Malware domains Sep 1st, 2013

Thu, Sep 1st 2013
#DhiaLite - Suspicious domains started resolving today to same IP 103.31.186.29 as in http://urlquery.net/report.php?id=4858199

xxxnuvidqzz.dnset.com
xxxnuvidufs.ddns.name
xxxnuvidhdl.ddns.name
xxxnuvidsom.dnset.com
xxxnuvidarp.ddns.name
xxxnuvidwov.ddns.name
xxxnuvidrbb.ddns.name
xxxnuvidoas.ddns.name

Live payloads on all domains under

/2013/hardcore-animal-sex-video.avi.exe
/2013/girl-fucked-by-dog.avi.exe

e.g.
http://xxxnuvidqzz.dnset.com/2013/hardcore-animal-sex-video.avi.exe

Example VT report
https://www.virustotal.com/en/file/cb4e9c8077f122bdfe6141b9ba69201de4c0ca3956a5ab5ec2a22576524b2d9c/analysis/1378054887/

Should just block the IP. It has only been hosting junk so far.