From VT: The DGA of FakeAV

[suqitian]

• MD5：
  2cb2cc33f56f0d6bada25dad5a18c767
• Link to VT
• Domains:
  xaxymivirocis.com
  vuforazaj.com
  fyzybopufanuj.com
  nyzysemadyk.com
  gavotataran.com
  pubepujiwusiwy.com
  zetofyhecynovu.com
  hypulycyfaqaba.com
  rehudomydefe.com
  vequtycarykeg.com
  nypucevys.com
  sesycifaqago.com
  lozebymova.com
  davizyzaky.com
  wihasiwaji.com
  cixizacakudyko.com
  qulygimokine.com
  dihojocitiz.com
  mimopywyn.com
  qobirawif.com
  gavywelugamoqe.com
  cikojavif.com
  rinysegaci.com
  mobesinolacuke.com
  xybobimaholos.com
  posubudiqof.com
  tucaxiqiwityp.com
  pulumacugefel.com
  sucejukas.com
  xopimynycerev.com
  jihamisunos.com
  qocakizali.com
  netiqugerin.com
  cimuxorazag.com
  juvizovih.com
  bivuzygaden.com
  bekukokymyje.com
  sowevicekem.com
  losajabevyjydu.com
  nibycexadytyn.com
  pekiwimozoha.com
  wohocebutiqy.com
  metuzamygyjo.com
  zokykajobu.com
  sabisocuci.com
  fazobugylov.com
  bivuxejak.com
  kofajisatum.com
  suqyjuxumo.com
  hijurefugeb.com
  xonibawylabep.com
  cajarihejeluw.com
• It should be a time independent DGA.

[suqitian]

138 suspicious DGA domains in total.

• Domains:

asitam.com
befukerycoxeqo.com
bekukokymyje.com
betikuxac.com
bivobakumuv.com
bivuxejak.com
bivuzygaden.com
bodiqynyjyjof.com
boqupyvuru.com
bykyxotiracym.com
cajarihejeluw.com
cikojavif.com
cimuxorazag.com
cixizacakudyko.com
cysuhevuzilu.com
dakygyzav.com
davizyzaky.com
dewyvoryr.com
dicutijavu.com
dihojocitiz.com
dijyjofubyt.com
farewakinutub.com
fatyfamafajomu.com
fazobugylov.com
fogozuxagod.com
fonywonunisiwu.com
fuxuvugyvupi.com
fyqesegyz.com
fyzybopufanuj.com
gajejunymepewo.com
gavotataran.com
gavywelugamoqe.com
gawezevahu.com
gaxuvanefi.com
hafugosek.com
hijurefugeb.com
horiqomep.com
huxogelew.com
hypulycyfaqaba.com
ithary.com
jagaxirecox.com
jeryqitego.com
jihamisunos.com
juvizovih.com
kakukunucatih.com
kebezyfademamu.com
kigutohigazem.com
kipuhazasalel.com
kirewyxipowapo.com
kofajisatum.com
kypojufiruqym.com
lanaky.com
lezidekuwo.com
lohyfyrasokiso.com
lolyvuqujusavy.com
losajabevyjydu.com
lozebymova.com
lypacomipe.com
megelokuro.com
merurelecotele.com
metuzamygyjo.com
miferyciq.com
mijywujysa.com
mimopywyn.com
moaria.com
mobesinolacuke.com
necofytebyhec.com
negujavigoken.com
netiqugerin.com
nezupuvopo.com
nibycexadytyn.com
nixyxakuluna.com
nydynedof.com
nynigywuheqe.com
nypucevys.com
nyzysemadyk.com
pekiwimozoha.com
pelituhypivi.com
pinoguzeseme.com
posubudiqof.com
pubepujiwusiwy.com
pulumacugefel.com
qamikumopy.com
qanuforil.com
qikodutef.com
qobirawif.com
qocakizali.com
qulygimokine.com
razapototohu.com
rehudomydefe.com
rinysegaci.com
sabisocuci.com
sarysyfagol.com
sesusihyt.com
sesycifaqago.com
solymutegyd.com
sosekozetekyp.com
sowevicekem.com
sozagyloby.com
sucejukas.com
sujarijic.com
suqyjuxumo.com
surnai.com
suxopuxoki.com
sylisapubyk.com
teguwumefu.com
tucaxiqiwityp.com
tytolinok.com
vahijitenate.com
vaxipyzateviwa.com
vequtycarykeg.com
vimysoqecuci.com
vizizurevypa.com
vowoputaru.com
vuforazaj.com
vyganison.com
vywuqybedyhad.com
wabypukov.com
wavysyfykylic.com
wewaqaloqad.com
wewynipuc.com
wicejodahiqe.com
wihasiwaji.com
wisobivesu.com
wohocebutiqy.com
wyqaqitasulaz.com
wyxegyzyxafyse.com
xabovarulysemo.com
xaxymivirocis.com
xibyxanati.com
xihacedugywo.com
xonibawylabep.com
xopimynycerev.com
xybobimaholos.com
zetofyhecynovu.com
zisixexaboci.com
zokykajobu.com
zujytuhehok.com

[suqitian]

Other samples which have the same behaviours, 96 binaries in total.

• MD5s

058dbf875efc7b058d2c6682fec5bc3e
919003c85be988f5b399077bff8a6ac0
ae9b1a3f2cefcfe4241c9916b737a02e
37cf3acd9ce03d8ade7a7e06f3c63a3f
5d348e2d4d2acdbe9d2ada96c1627b61
ab10dc4fd73c4f78c38a8e06fa62ba10
0e5a29d95099fc1680911db841b2fc87
48ccf985cddb66430133bfd6345f66c8
4ab025377c85a2de0b6ad8492527f7ab
6f236ec37ada49c98f2cfd22f70cdd86
7c3c4dba11f7ad2d331e296e891e37d4
8d2a3aff3c28260d04adc23f94e3536d
98310c309aa1a88d0c006dd3d65775d1
dd7b17ea3f35f0f52da10794031dd5b2
e4d8c4e1008bdcbdfd1378afa42cb174
e78eae37dd27b00e56cab991601ab1f0
fb2fd29bf296aa9ba29d0d21239772c4
08a645d3dee474c46fd2d7f7f84295e1
26ba5b020e19825707b046323a2eb783
33bd705e5b9539c016eb20290bc68f7d
4123686eb1219c524d89430b86d8c0d0
6c57e048da698ec508bd0ca90e596a52
89f1efe44aa74399d7b93354151f308e
8a6324a83222da831c2c320cb6bf0bfb
a79de63aa4eca57c0cc30bb75e98026c
aae8228aea5d2a0c0b0fc29b01eba4c4
ad05b2e96c3d45fd2fbd4d9950c38637
bc5da09f83cb2e5233256497082b1478
c11cb548cd665adccb14722a7b0518a8
c9aab087c167110d825606f70cac17c3
e285e305f4b48c41fe4fded7a94deb83
fbc1926d9fd7973dbc71444d8e4e4bcd
1cfad0e471493f21fdcba951f5f63151
44a90cd141575a22019367dcefe9227b
74657a67a4a9b9deb8af0905e5f5c63c
7853dcbaa4c429e3ca21c30663146936
a5979745cd96d9a7093b4078b0b2d10c
ba63bd9e1290895c2083862e76b0a836
d80a86f3380969ab168f95803460cf2e
e0f413347c9efd639170330a0e77c059
e664fae36726e097d45632adcb2f632c
ece9ddb06777150976e352f79a67c128
016a0ff812e5c75db96eff02d8ddfeea
11a83444636a6537f3d8213ee62a8474
1627db3a83078fea925bcf476cd569e5
185fb9ce5a4e7cc6c06a12830bf8f0ee
1938cc29c0f7bc00bda8d47330dca4fb
1b8beed9d3b8afb3f8836751fe8c1005
296afc28e751bafc81a1cff5b1a4b35d
2ef804dc028bb6b1dc6dac75778b77e4
2f1600b462c4d7169bde11c02887fb7d
359c522ebdc6751af76f52e7b8c69a7c
3e83f7651e9745c7cd4cd8107d86cbae
5da1959d808c2f528acf9f405deea05d
634044e2ea97c8528503653e9fc8ca25
660664805a4c6930487a1f5642bced00
740ed573fae3ec7caba11b0e32920f0f
7c8aa94d432e7f628fbdbc524083d904
8225832dc1f83e594b4f39f9f9a89b8a
95c93805f25ba1da197923be383b1c51
97a6c71fe253ea42631ccd6ba91c658d
a19e71ae2ee8bed34045cdad4cbe7bc1
a3111185ce225124dfdba72147c4623e
a81d14f46b0f7623f623bde8ed02273c
aa1816fa7979843b1a294382eff05ec3
b2024349a2e3c08679cb76fa891bf030
b2d4d8ed387a86d9ed8183158ffd9e61
c3f473060c0535d9022cbdff9468b510
cf21fe0fd6e80af9df92bf2ca0294034
ed51bfa2ce89638b235bd23815e23f1c
068ccf4583a1a0dd1f1ca21ab9bc2044
0d8c33c9a5870dde13ec312d2097c85a
112d45545b581432c7a92464ed086f44
146efbe7d4dac9ddbc5d25af39526576
23b9b6724c29f460b2c6ad7c7a46051b
29331a5dcaa981bb579016ee7fd5c430
56f18b71cc088d955519d7d6366ba7b6
5e0c3665a6905b8b029525cdd9a0058c
6fca0a30564bcd1835a8140a3b9179e8
71d4b8d05a20d613d049091bafc2111b
854dfb5ac11f943c7f84e73ee37e552d
a0fcfa62c5b263303912aca29f4aee0d
a655e469c398e997984fda95579c9233
a74e5d2919a066823efe025e9caddee5
ae951f7f34b9c05cc8598092be6aaa5a
b905a0291fbfbe9b7e64ae833d216408
c06d3376668b40897286959639b37bd6
c1e247d526f1d9870d3c1eab3215e2d7
ca86ca37a51d38cacc27510e37521caf
d9833974f5846d883ec895071ff8c795
de21449b39a3e223f63fcb65bbccd75e
df14ce9aabd7f014ce66b6a4ab7c4546
f0d0872763058e047922ead2474943ec
fb9b3cdd7d58de56f86043814d96872d

[suqitian]

Not DGA.