The DGA of Sisron
Excerpt
Sisron was part of a financial fraud and identity theft botnet. It was taken down by Microsoft in the anti-botnet operation B106. The malware uses a very simple domain generation algorithm (DGA) that produces sets of similar looking domains.
mjawmjiwmtia.com
mjawmjiwmtia.org
mjewmjiwmtia.com
mjewmjiwmtia.org
mjiwmjiwmtia.com
mjiwmjiwmtia.org
mjmwmjiwmtia.com
mjmwmjiwmtia.org
mjqwmjiwmtia.com
mjqwmjiwmtia.org
mtcwmjiwmtia.com
mtcwmjiwmtia.org
mtgwmjiwmtia.com
mtgwmjiwmtia.org
mtkwmjiwmtia.com
mtkwmjiwmtia.org
mtuwmjiwmtia.com
mtywmjiwmtia.com
mtywmjiwmtia.org
In this write-up I show:
generated;
Prevalence and Names
For example, these are some of the domains listed in a Sophos report:
when t…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by bin.re on bin.re.
Mentioned in the excerpt
More from bin.re1
- A JavaScript-based DGA - Analysis of a defunct Proslikefan Samplebin.re · Added 4 Jun
On the same topics
- Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware FamilySilent Push · Published 4 Feb
- JDY Botnet: How IoT and SOHO Devices Are ExploitedLumen Black Lotus Labs · Added 10 Oct
- threat-research/ancient-botnet at main · ksi-digital/threat-researchGitHub · Added 7 Oct
