A JavaScript-based DGA - Analysis of a defunct Proslikefan Sample – bin.re

Excerpt

Note 2016-06-17: I later found a fully functional sample of Proslikefan and wrote about it here. Please check out the newer blog post in favor of this post. I leave this write-up of Proslikefan up, with some minor edits to reflect findings I obtained by examining a more complete Proslikefan sample.

This JavaScript on Malwr.com from November 23, 2015 caught my attention because of the contacted domains:

133754.cc 64.62.224.253

vvoxox.eu

jarvis.co

cudbbwsff.eu

fdqawiz.eu

ahmxwyw.eu

vyyltt.cc

ldpkyawb.co

dnbqig.eu

cfzqzyuf.eu

pujdmzqb.cc

mxkuchq.co

ocwzueix.cc

Only the first domain resolves to an IP (in the US). The fourth and subsequent domains are generated by a Domain Ge…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by bin.re on bin.re.

A JavaScript-based DGA - Analysis of a defunct Proslikefan Sample