Feed

RunForestRun DGA Update

Posted on July 26th, 2012 in 0day,New Domains by dglosser

http://blog.unmaskparasites.com/2012/07/26/runforestrun-now-encrypts-legitimate-js-files/

RunForestRun has changed the domain generating algorithm (DGA),  and now uses waw.pl subdomains (instead of .ru) in malicious URLs.

Update: the full list of predicted domains is here:  http://pastebin.com/8tfexYE3

Comments are closed.