// Credential stealer via BHEK2 // Shutdown Domain List up to Dec 23rd 2012, // Reported as per Dec 24, 2012 // Analyzed, reported & Monitored by: #MalwareMustDie // Reported Case list: // http://malwaremustdie.blogspot.jp/2012/12/more-spam-to-bhek-to-cridex-how-they.html?utm_source=BP_recent // http://malwaremustdie.blogspot.jp/2012/12/list-of-name-server-used-by-blackhole.html?utm_source=BP_recent // http://malwaremustdie.blogspot.jp/2012/12/fake-facebook-notification-leads-to.html // http://malwaremustdie.blogspot.jp/2012/11/full-disclosure-analysis-fake-facebook.html // http://malwaremustdie.blogspot.jp/2012/12/spam-wordpress-redirector.html With the help of all involved crusaders, with the coordination of .RU authorithies, Cert-GIB & registrars related, hereby we inform that the reported Malware Infector Domains as per listed & proved below are down & no sign of re-apparance. However, since the criminals still free, we expect to meet their work, analyze, report, exposed their crime too, for we #MalwareMustDie will be as tireless as these bad actors. It is not that what so called bullet proof domains is so invincible to destroy, but it is just a matter of time that the coordination of the good people in internet will outcome a good result like this. The quantity of domains may not look so much, but these data also backed up with hundreds of IPs, upt o 30 mis-used DNS server lists, which we cannot expose, and by God speed, is not mis-used no more. Gentlemen, we shall outsmart them, don't let these bad actors sleep too well! //List of domain.. genevaonline.ru pelamutrika.ru aliamognoa.ru ahiontota.ru anifkailood.ru podarunoki.ru aseniakrol.ru publicatorian.ru pitoniamason.ru amnaosogo.ru aviaonlolsio.ru dimarikanko.ru adanagenro.ru awoeionfpop.ru aofngppahgor.ru aviaonlolsio.ru ganalionomka.ru publicatorian.ru francese.ru cinemaallon.ru leberiasun.ru somaliaonfloor.ru panamechkis.ru apendiksator.ru angelaonfl.ru adanagenro.ru antariktika.ru aliamognoa.ru apensiona.ru anifkailood.ru apolinaklsit.ru sectantes-x.ru : (and some older .RU domains belong to same moronz group) //PoC: > genevaonline.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find genevaonline.ru: Non-existent domain > pelamutrika.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find pelamutrika.ru: Non-existent domain > aliamognoa.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find aliamognoa.ru: Non-existent domain > ahiontota.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find ahiontota.ru: Non-existent domain > anifkailood.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find anifkailood.ru: Non-existent domain > podarunoki.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find podarunoki.ru: Non-existent domain > aseniakrol.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find aseniakrol.ru: Non-existent domain > publicatorian.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find publicatorian.ru: Non-existent domain > pitoniamason.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find pitoniamason.ru: Non-existent domain > amnaosogo.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find amnaosogo.ru: Non-existent domain > aviaonlolsio.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find aviaonlolsio.ru: Non-existent domain > dimarikanko.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find dimarikanko.ru: Non-existent domain > adanagenro.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find adanagenro.ru: Non-existent domain > awoeionfpop.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find awoeionfpop.ru: Non-existent domain > aofngppahgor.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find aofngppahgor.ru: Non-existent doma in > aviaonlolsio.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find aviaonlolsio.ru: Non-existent domain > ganalionomka.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find ganalionomka.ru: Non-existent domain > publicatorian.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find publicatorian.ru: Non-existent domain > > francese.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find francese.ru: Non-existent domain > cinemaallon.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find cinemaallon.ru: Non-existent domain > leberiasun.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find leberiasun.ru: Non-existent domain > somaliaonfloor.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find somaliaonfloor.ru: Non-existent domain > panamechkis.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find panamechkis.ru: Non-existent domain > > apendiksator.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find apendiksator.ru: Non-existent domain > angelaonfl.ru Server: google-public-dns-a.google.com Address: 8.8.8.8 *** google-public-dns-a.google.com can't find angelaonfl.ru: Non-existent domain > adanagenro.ru Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find adanagenro.ru: NXDOMAIN > antariktika.ru > aliamognoa.ru > apensiona.ru > anifkailood.ru > apolinaklsit.ru > Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find antariktika.ru: NXDOMAIN > Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find aliamognoa.ru: NXDOMAIN > Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find apensiona.ru: NXDOMAIN > Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find anifkailood.ru: NXDOMAIN > Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find apolinaklsit.ru: NXDOMAIN > sectantes-x.ru Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find sectantes-x.ru: NXDOMAIN --- #MalwareMustDie!!