Skip to content

From VT: New seed of Randomloader DGA? #8

New issue
New issue
Open
Open
From VT: New seed of Randomloader DGA?#8
@suqitian

Description

@suqitian
suqitian
opened on Aug 30, 2016
  • MD5
    baf268f88c0bf8501efe2cdeee712ce1
  • Domains from VT sandbox
    cgyck.museum
    cimumks.nu
    fyyayyyoc.vg
    gtxwwagzv.vg
    gymsuagbjpr.mp
    icmok.tk
    kohydmqzd.ws
    mfcqlfmve.museum
    mmqcwjzykqs.tk
    pesoeyxgwcc.cd
    psufsoqsgkquy.museum
    qluwbykqusk.cd
    tvoaikyqpk.cd
    ucymkoe.pw
    ugmkgqi.tk
    vouysxzkmebw.cd
    wiynq.mp
    yshcnqopiuz.pw
  • This sample dropped a file: C:\WINDOWS\system32\rmass.exe. Run it and kill the process tree again and again, some suspicious DGA domains would be captured by Wireshark.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions