From PDNS: A fix length of 22, tlds:[in, ru, su]

[360netlab]

From PDNS: A fix length of 22, tlds:[in, ru, su]

[suqitian]

• Hard-coded domains
• MD5: 2d1a8c73b3619937e367d139c5ac393c
• Strings in sample:

.rdata:004038A8 00000022 C http://srgsougshfouaoehfaghae.ru/
.rdata:004038CC 00000022 C http://aefiabeuodbauobfaoebbf.ru/
.rdata:004038F0 00000022 C http://aoeubfoabeoufadaeufoue.ru/
.rdata:00403914 00000022 C http://awdauegdouegfageuofguo.ru/
.rdata:00403938 00000022 C http://pfeakpfiahefupafoahefd.ru/
.rdata:0040395C 00000022 C http://aeiueigafiegfaiedeiuag.ru/
.rdata:00403980 00000022 C http://afeoadaueodgeouaoueofu.ru/
.rdata:004039A4 00000022 C http://arsohoduauahfhofuhfdus.ru/
.rdata:004039C8 00000022 C http://auiaaedabzabevbiiedizf.ru/
.rdata:004039EC 00000022 C http://aefouaeaooaobaubvaeubv.ru/
.rdata:00403A10 00000022 C http://srgsougshfouaoehfaghae.su/
.rdata:00403A34 00000022 C http://aefiabeuodbauobfaoebbf.su/
.rdata:00403A58 00000022 C http://aoeubfoabeoufadaeufoue.su/
.rdata:00403A7C 00000022 C http://awdauegdouegfageuofguo.su/
.rdata:00403AA0 00000022 C http://pfeakpfiahefupafoahefd.su/
.rdata:00403AC4 00000022 C http://aeiueigafiegfaiedeiuag.su/
.rdata:00403AE8 00000022 C http://afeoadaueodgeouaoueofu.su/
.rdata:00403B0C 00000022 C http://arsohoduauahfhofuhfdus.su/
.rdata:00403B30 00000022 C http://auiaaedabzabevbiiedizf.su/
.rdata:00403B54 00000022 C http://aefouaeaooaobaubvaeubv.su/
.rdata:00403B78 00000022 C http://srgsougshfouaoehfaghae.in/
.rdata:00403B9C 00000022 C http://aefiabeuodbauobfaoebbf.in/
.rdata:00403BC0 00000022 C http://aoeubfoabeoufadaeufoue.in/
.rdata:00403BE4 00000022 C http://awdauegdouegfageuofguo.in/
.rdata:00403C08 00000022 C http://pfeakpfiahefupafoahefd.in/
.rdata:00403C2C 00000022 C http://aeiueigafiegfaiedeiuag.in/
.rdata:00403C50 00000022 C http://afeoadaueodgeouaoueofu.in/
.rdata:00403C74 00000022 C http://arsohoduauahfhofuhfdus.in/
.rdata:00403C98 00000022 C http://auiaaedabzabevbiiedizf.in/
.rdata:00403CBC 00000022 C http://aefouaeaooaobaubvaeubv.in/

[suqitian]

• Another cluster

aefiabeuodbauobfafoebbf.in
aefiabeuodbauobfafoebbf.net
aefiabeuodbauobfafoebbf.su
aefiabeuodbauobfaoebbfh.ru
aizgaizdgigzaigdiaegfgi.in
aizgaizdgigzaigdiaegfgi.net
aizgaizdgigzaigdiaegfgi.ru
aizgaizdgigzaigdiaegfgi.su
eigegaugeifgaiueidaeguf.in
eigegaugeifgaiueidaeguf.net
eigegaugeifgaiueidaeguf.ru
eigegaugeifgaiueidaeguf.su
eiugfeagfigaefiuagefuga.in
eiugfeagfigaefiuagefuga.net
eiugfeagfigaefiuagefuga.ru
eiugfeagfigaefiuagefuga.su
oufgaeougf9aegf9age9fga.in
oufgaeougf9aegf9age9fga.net
oufgaeougf9aegf9age9fga.ru
oufgaeougf9aegf9age9fga.su
saeuofgaeiufiaefgiaffgi.in
saeuofgaeiufiaefgiaffgi.net
saeuofgaeiufiaefgiaffgi.ru
saeuofgaeiufiaefgiaffgi.su
srgsougshfouaoehfagdhae.in
srgsougshfouaoehfagdhae.net
srgsougshfouaoehfagdhae.su
srgsougshfouaoehfaghaed.ru

• MD5: d9538bf92880b497f5d1adfb935cdd7b
• Strings in sample

.rdata:00404B84 00000023 C http://srgsougshfouaoehfaghaed.ru/ 
.rdata:00404BA8 00000023 C http://aefiabeuodbauobfaoebbfh.ru/ 
.rdata:00404BCC 00000023 C http://saeuofgaeiufiaefgiaffgi.ru/ 
.rdata:00404BF0 00000023 C http://oufgaeougf9aegf9age9fga.ru/ 
.rdata:00404C14 00000023 C http://eigegaugeifgaiueidaeguf.ru/ 
.rdata:00404C38 00000023 C http://eiugfeagfigaefiuagefuga.ru/ 
.rdata:00404C5C 00000023 C http://aizgaizdgigzaigdiaegfgi.ru/ 
.rdata:00404C80 00000023 C http://srgsougshfouaoehfagdhae.su/ 
.rdata:00404CA4 00000023 C http://aefiabeuodbauobfafoebbf.su/ 
.rdata:00404CC8 00000023 C http://saeuofgaeiufiaefgiaffgi.su/ 
.rdata:00404CEC 00000023 C http://oufgaeougf9aegf9age9fga.su/ 
.rdata:00404D10 00000023 C http://eigegaugeifgaiueidaeguf.su/ 
.rdata:00404D34 00000023 C http://eiugfeagfigaefiuagefuga.su/ 
.rdata:00404D58 00000023 C http://aizgaizdgigzaigdiaegfgi.su/ 
.rdata:00404D7C 00000023 C http://srgsougshfouaoehfagdhae.in/ 
.rdata:00404DA0 00000023 C http://aefiabeuodbauobfafoebbf.in/ 
.rdata:00404DC4 00000023 C http://saeuofgaeiufiaefgiaffgi.in/ 
.rdata:00404DE8 00000023 C http://oufgaeougf9aegf9age9fga.in/ 
.rdata:00404E0C 00000023 C http://eigegaugeifgaiueidaeguf.in/ 
.rdata:00404E30 00000023 C http://eiugfeagfigaefiuagefuga.in/ 
.rdata:00404E54 00000023 C http://aizgaizdgigzaigdiaegfgi.in/ 
.rdata:00404E78 00000024 C http://srgsougshfouaoehfagdhae.net/
.rdata:00404E9C 00000024 C http://aefiabeuodbauobfafoebbf.net/
.rdata:00404EC0 00000024 C http://saeuofgaeiufiaefgiaffgi.net/
.rdata:00404EE4 00000024 C http://oufgaeougf9aegf9age9fga.net/
.rdata:00404F08 00000024 C http://eigegaugeifgaiueidaeguf.net/
.rdata:00404F2C 00000024 C http://eiugfeagfigaefiuagefuga.net/
.rdata:00404F50 00000024 C http://aizgaizdgigzaigdiaegfgi.net/

[suqitian]

• A new cluster, fix length of 16

aeigfiagegoenguoa.com
aeigfiagegoenguoa.net
aeigfiagegoenguoa.su
aouehfuugheugusu.biz
aouehfuugheugusu.com
aouehfuugheugusu.in
aouehfuugheugusu.net
aouehfuugheugusu.su
atzieaeiegfzagef.biz
atzieaeiegfzagef.com
atzieaeiegfzagef.in
atzieaeiegfzagef.net
atzieaeiegfzagef.ru
atzieaeiegfzagef.su
auaegofeogaefuee.biz
auaegofeogaefuee.com
auaegofeogaefuee.in
auaegofeogaefuee.net
auaegofeogaefuee.ru
auaegofeogaefuee.su
azdgdizaegigazief.net
gazieubzbazergsh.biz
gazieubzbazergsh.com
gazieubzbazergsh.in
gazieubzbazergsh.net
gazieubzbazergsh.ru
gazieubzbazergsh.su
ieguaoeuafhoauedg.com
ieguaoeuafhoauedg.in
noeugfouegfouage.biz
noeugfouegfouage.com
noeugfouegfouage.in
noeugfouegfouage.net
noeugfouegfouage.ru
noeugfouegfouage.su
oaehfoaefohaeuau.biz
oaehfoaefohaeuau.com
oaehfoaefohaeuau.in
oaehfoaefohaeuau.net
oaehfoaefohaeuau.ru
oaehfoaefohaeuau.su
oeufoueafuegeuoh.ru
ofoanefubehauufdu.biz
ofoanefubehauufdu.in
ofoanefubehauufdu.ru
ohoaounoaeubagoeu.in
ohoaounoaeubagoeu.su
osgohfoeaugfoauef.in
oueouaeouannngewa.biz
oueouaeouannngewa.com
oueuofabofuaetae.biz
oueuofabofuaetae.com
oueuofabofuaetae.in
oueuofabofuaetae.net
oueuofabofuaetae.ru
oueuofabofuaetae.su
oughoehfaefaeubob.biz
oughoehfaefaeubob.com
oughoehfaefaeubob.in
ougoauhuoehfogee.biz
ougoauhuoehfogee.com
ougoauhuoehfogee.in
ougoauhuoehfogee.net
ougoauhuoehfogee.ru
ougoauhuoehfogee.su
ozueazoaufauhfuer.com
ozueazoaufauhfuer.su
rtzuwfgefvuvfuge.biz
rtzuwfgefvuvfuge.com
rtzuwfgefvuvfuge.in
rtzuwfgefvuvfuge.net
rtzuwfgefvuvfuge.su
ubofuabneuafaohog.com
ubofuabneuafaohog.ru

• Not DGA
• MD5: 2dca49e6dc55960faa0499dd10010e3b
• Strings in sample

http://noeugfouegfouage.ru/
http://oeufoueafuegeuoh.ru/
http://gazieubzbazergsh.ru/
http://auaegofeogaefuee.ru/
http://plpanaifheaighai.ru/
http://iuefgauiaiduihgs.ru/
http://oueuofabofuaetae.ru/
http://ougoauhuoehfogee.ru/
http://atzieaeiegfzagef.ru/
http://oaehfoaefohaeuau.ru/
http://aouehfuugheugusu.su/
http://noeugfouegfouage.su/
http://gazieubzbazergsh.su/
http://auaegofeogaefuee.su/
http://rtzuwfgefvuvfuge.su/
http://iuefgauiaiduihgs.su/
http://oueuofabofuaetae.su/
http://ougoauhuoehfogee.su/
http://atzieaeiegfzagef.su/
http://oaehfoaefohaeuau.su/
http://aouehfuugheugusu.in/
http://noeugfouegfouage.in/
http://gazieubzbazergsh.in/
http://auaegofeogaefuee.in/
http://rtzuwfgefvuvfuge.in/
http://iuefgauiaiduihgs.in/
http://oueuofabofuaetae.in/
http://ougoauhuoehfogee.in/
http://atzieaeiegfzagef.in/
http://oaehfoaefohaeuau.in/
http://aouehfuugheugusu.net/
http://noeugfouegfouage.net/
http://gazieubzbazergsh.net/
http://auaegofeogaefuee.net/
http://rtzuwfgefvuvfuge.net/
http://iuefgauiaiduihgs.net/
http://oueuofabofuaetae.net/
http://ougoauhuoehfogee.net/
http://atzieaeiegfzagef.net/
http://oaehfoaefohaeuau.net/
http://aouehfuugheugusu.com/
http://noeugfouegfouage.com/
http://gazieubzbazergsh.com/
http://auaegofeogaefuee.com/
http://rtzuwfgefvuvfuge.com/
http://iuefgauiaiduihgs.com/
http://oueuofabofuaetae.com/
http://ougoauhuoehfogee.com/
http://atzieaeiegfzagef.com/
http://oaehfoaefohaeuau.com/
http://aouehfuugheugusu.biz/
http://noeugfouegfouage.biz/
http://gazieubzbazergsh.biz/
http://auaegofeogaefuee.biz/
http://rtzuwfgefvuvfuge.biz/
http://iuefgauiaiduihgs.biz/
http://oueuofabofuaetae.biz/
http://ougoauhuoehfogee.biz/
http://atzieaeiegfzagef.biz/
http://oaehfoaefohaeuau.biz/

[suqitian]

• Not DGA
• MD5: e394a20ea1db751ada8f1e1066900866
• Strings in sample

http://booomaahuuoooapl.ru/
http://eoufaoeuhoauengi.ru/
http://maeobnaoefhgoajo.ru/
http://ashihsijaediaehf.ru/
http://plpanaifheaighai.ru/
http://iuefgauiaiduihgs.ru/
http://aeiziaezieidiebg.ru/
http://aneoeauhiazegfiz.ru/
http://uoaeogauhduadhug.ru/
http://plpoiupakludkosa.ru/
http://booomaahuuoooapl.su/
http://eoufaoeuhoauengi.su/
http://maeobnaoefhgoajo.su/
http://ashihsijaediaehf.su/
http://plpanaifheaighai.su/
http://iuefgauiaiduihgs.su/
http://aeiziaezieidiebg.su/
http://aneoeauhiazegfiz.su/
http://uoaeogauhduadhug.su/
http://plpoiupakludkosa.su/
http://booomaahuuoooapl.in/
http://eoufaoeuhoauengi.in/
http://maeobnaoefhgoajo.in/
http://ashihsijaediaehf.in/
http://plpanaifheaighai.in/
http://iuefgauiaiduihgs.in/
http://aeiziaezieidiebg.in/
http://aneoeauhiazegfiz.in/
http://uoaeogauhduadhug.in/
http://plpoiupakludkosa.in/
http://booomaahuuoooapl.net/
http://eoufaoeuhoauengi.net/
http://maeobnaoefhgoajo.net/
http://ashihsijaediaehf.net/
http://plpanaifheaighai.net/
http://iuefgauiaiduihgs.net/
http://aeiziaezieidiebg.net/
http://aneoeauhiazegfiz.net/
http://uoaeogauhduadhug.net/
http://plpoiupakludkosa.net/
http://booomaahuuoooapl.com/
http://eoufaoeuhoauengi.com/
http://maeobnaoefhgoajo.com/
http://ashihsijaediaehf.com/
http://plpanaifheaighai.com/
http://iuefgauiaiduihgs.com/
http://aeiziaezieidiebg.com/
http://aneoeauhiazegfiz.com/
http://uoaeogauhduadhug.com/
http://plpoiupakludkosa.com/
http://booomaahuuoooapl.biz/
http://eoufaoeuhoauengi.biz/
http://maeobnaoefhgoajo.biz/
http://ashihsijaediaehf.biz/
http://plpanaifheaighai.biz/
http://iuefgauiaiduihgs.biz/
http://aeiziaezieidiebg.biz/
http://aneoeauhiazegfiz.biz/
http://uoaeogauhduadhug.biz/
http://plpoiupakludkosa.biz/

[suqitian]

• Not DGA
• MD5: a36513be78741ee35432f0c3fe4af942, 5a1312f871ed5da741d836cad5c33076
• Strings in samples

http://sroghosfuoehfoaefua.ru/
http://soghsorhosruuosrfha.ru/
http://eizfgziaeaizgdeaifa.ru/
http://buabcoueaboufaefofa.ru/
http://iazefzaebdaezfizara.ru/
http://awiziazgdizagwdwaia.ru/
http://azidbazediagzeagiaa.ru/
http://ohafogeiauoahadehfa.ru/
http://aizefabdzizezezezra.ru/
http://aebizabizeziizazera.ru/
http://iazezgruaroarouadfa.ru/
http://buaebnnnsnsnsnsufja.ru/
http://oauendnnnnnvnhshhra.ru/
http://mnbnvjdjsisidifueua.ru/
http://oauufeofahfueuueuea.ru/
http://pspspspckjuuuufufua.ru/
http://auauauauaaauaaudaga.ru/
http://pspspspgkurueuduuda.ru/
http://soufgoueuueueufhfna.ru/
http://dpddlrivhzdhsuvuhea.ru/
http://uauueueunddjvgsnsia.ru/
http://sususuhfbtehszfgura.ru/
http://paeiguueiugzgjususa.ru/
http://brfudgzbisfiuefzgsa.ru/
http://oosouegafuaodeuadga.ru/
http://sroghosfuoehfoaefub.su/
http://soghsorhosruuosrfhb.su/
http://eizfgziaeaizgdeaifb.su/
http://buabcoueaboufaefofb.su/
http://iazefzaebdaezfizarb.su/
http://awiziazgdizagwdwaib.su/
http://azidbazediagzeagiab.su/
http://ohafogeiauoahadehfb.su/
http://aizefabdzizezezezrb.su/
http://aebizabizeziizazerb.su/
http://iazezgruaroarouadfb.su/
http://buaebnnnsnsnsnsufjb.su/
http://oauendnnnnnvnhshhrb.su/
http://mnbnvjdjsisidifueub.su/
http://oauufeofahfueuueueb.su/
http://pspspspckjuuuufufub.su/
http://auauauauaaauaaudagb.su/
http://pspspspgkurueuduudb.su/
http://soufgoueuueueufhfnb.su/
http://dpddlrivhzdhsuvuheb.su/
http://uauueueunddjvgsnsib.su/
http://sususuhfbtehszfgurb.su/
http://paeiguueiugzgjususb.su/
http://brfudgzbisfiuefzgsb.su/
http://oosouegafuaodeuadgb.su/
http://sroghosfuoehfoaefuc.in/
http://soghsorhosruuosrfhc.in/
http://eizfgziaeaizgdeaifc.in/
http://buabcoueaboufaefofc.in/
http://iazefzaebdaezfizarc.in/
http://awiziazgdizagwdwaic.in/
http://azidbazediagzeagiac.in/
http://ohafogeiauoahadehfc.in/
http://aizefabdzizezezezrc.in/
http://aebizabizeziizazerc.in/
http://iazezgruaroarouadfc.in/
http://buaebnnnsnsnsnsufjc.in/
http://oauendnnnnnvnhshhrc.in/
http://mnbnvjdjsisidifueuc.in/
http://oauufeofahfueuueuec.in/
http://pspspspckjuuuufufuc.in/
http://auauauauaaauaaudagc.in/
http://pspspspgkurueuduudc.in/
http://soufgoueuueueufhfnc.in/
http://dpddlrivhzdhsuvuhec.in/
http://uauueueunddjvgsnsic.in/
http://sususuhfbtehszfgurc.in/
http://paeiguueiugzgjususc.in/
http://brfudgzbisfiuefzgsc.in/
http://sroghosfuoehfoaefud.to/
http://soghsorhosruuosrfhd.to/
http://eizfgziaeaizgdeaifd.to/
http://buabcoueaboufaefofd.to/
http://iazefzaebdaezfizard.to/
http://awiziazgdizagwdwaid.to/
http://azidbazediagzeagiad.to/
http://ohafogeiauoahadehfd.to/
http://aizefabdzizezezezrd.to/
http://aebizabizeziizazerd.to/
http://iazezgruaroarouadfd.to/
http://buaebnnnsnsnsnsufjd.to/
http://oauendnnnnnvnhshhrd.to/
http://mnbnvjdjsisidifueud.to/
http://oauufeofahfueuueued.to/
http://pspspspckjuuuufufud.to/
http://auauauauaaauaaudagd.to/
http://pspspspgkurueuduudd.to/
http://soufgoueuueueufhfnd.to/
http://dpddlrivhzdhsuvuhed.to/
http://uauueueunddjvgsnsid.to/
http://sususuhfbtehszfgurd.to/
http://paeiguueiugzgjususd.to/
http://brfudgzbisfiuefzgsd.to/
http://oosouegafuaodeuadgd.to/
http://sroghosfuoehfoaefue.biz/
http://soghsorhosruuosrfhe.biz/
http://eizfgziaeaizgdeaife.biz/
http://buabcoueaboufaefofe.biz/
http://iazefzaebdaezfizare.biz/
http://awiziazgdizagwdwaie.biz/
http://azidbazediagzeagiae.biz/
http://ohafogeiauoahadehfe.biz/
http://aizefabdzizezezezre.biz/
http://aebizabizeziizazere.biz/
http://iazezgruaroarouadfe.biz/
http://buaebnnnsnsnsnsufje.biz/
http://oauendnnnnnvnhshhre.biz/
http://mnbnvjdjsisidifueue.biz/
http://oauufeofahfueuueuee.biz/
http://pspspspckjuuuufufue.biz/
http://auauauauaaauaaudage.biz/
http://pspspspgkurueuduude.biz/
http://soufgoueuueueufhfne.biz/
http://dpddlrivhzdhsuvuhee.biz/
http://uauueueunddjvgsnsie.biz/
http://sususuhfbtehszfgure.biz/
http://paeiguueiugzgjususe.biz/
http://brfudgzbisfiuefzgse.biz/
http://oosouegafuaodeuadge.biz/
http://sroghosfuoehfoaefuf.net/
http://soghsorhosruuosrfhf.net/
http://eizfgziaeaizgdeaiff.net/
http://buabcoueaboufaefoff.net/
http://iazefzaebdaezfizarf.net/
http://awiziazgdizagwdwaif.net/
http://azidbazediagzeagiaf.net/
http://ohafogeiauoahadehff.net/
http://aizefabdzizezezezrf.net/
http://aebizabizeziizazerf.net/
http://iazezgruaroarouadff.net/
http://buaebnnnsnsnsnsufjf.net/
http://oauendnnnnnvnhshhrf.net/
http://mnbnvjdjsisidifueuf.net/
http://oauufeofahfueuueuef.net/
http://pspspspckjuuuufufuf.net/
http://auauauauaaauaaudagf.net/
http://pspspspgkurueuduudf.net/
http://soufgoueuueueufhfnf.net/
http://dpddlrivhzdhsuvuhef.net/
http://uauueueunddjvgsnsif.net/
http://sususuhfbtehszfgurf.net/
http://paeiguueiugzgjususf.net/
http://brfudgzbisfiuefzgsf.net/
http://oosouegafuaodeuadgf.net/
http://sroghosfuoehfoaefug.com/
http://soghsorhosruuosrfhg.com/
http://eizfgziaeaizgdeaifg.com/
http://buabcoueaboufaefofg.com/
http://iazefzaebdaezfizarg.com/
http://awiziazgdizagwdwaig.com/
http://azidbazediagzeagiag.com/
http://ohafogeiauoahadehfg.com/
http://aizefabdzizezezezrg.com/
http://aebizabizeziizazerg.com/
http://iazezgruaroarouadfg.com/
http://buaebnnnsnsnsnsufjg.com/
http://oauendnnnnnvnhshhrg.com/
http://mnbnvjdjsisidifueug.com/
http://oauufeofahfueuueueg.com/
http://pspspspckjuuuufufug.com/
http://auauauauaaauaaudagg.com/
http://pspspspgkurueuduudg.com/
http://soufgoueuueueufhfng.com/
http://dpddlrivhzdhsuvuheg.com/
http://uauueueunddjvgsnsig.com/
http://sususuhfbtehszfgurg.com/
http://paeiguueiugzgjususg.com/
http://brfudgzbisfiuefzgsg.com/
http://oosouegafuaodeuadgg.com/
http://sroghosfuoehfoaefux.info/
http://soghsorhosruuosrfhx.info/
http://eizfgziaeaizgdeaifx.info/
http://buabcoueaboufaefofx.info/
http://iazefzaebdaezfizarx.info/
http://awiziazgdizagwdwaix.info/
http://azidbazediagzeagiax.info/
http://ohafogeiauoahadehfx.info/
http://aizefabdzizezezezrx.info/
http://aebizabizeziizazerx.info/
http://iazezgruaroarouadfx.info/
http://buaebnnnsnsnsnsufjx.info/
http://oauendnnnnnvnhshhrx.info/
http://mnbnvjdjsisidifueux.info/
http://oauufeofahfueuueuex.info/
http://pspspspckjuuuufufux.info/
http://auauauauaaauaaudagx.info/
http://pspspspgkurueuduudx.info/
http://soufgoueuueueufhfnx.info/
http://dpddlrivhzdhsuvuhex.info/
http://uauueueunddjvgsnsix.info/
http://sususuhfbtehszfgurx.info/
http://paeiguueiugzgjususx.info/
http://brfudgzbisfiuefzgsx.info/
http://oosouegafuaodeuadgx.info/