Publish Forum topic Publish your post to the cyberwarzone forum for free and no registration!

Swiss CERT cracked the Tofsee botnet DGA

The Tofsee botnet domain generation algorithm has been cracked by the Swiss Governmental Computer Emergency Response Team. The CERT states that the malware sample was found in their malware zoo, and that they decided to take a closer look at the malware sample as it was showing DGA behavior.

During their research, they were able to create a list of domains which will be used by the Tofsee botnet. The domains which were generated, will allow the CERT and all the companies that have the IOCs to track the Tofsee botnet for 52 weeks.

They state that they contacted the registry of cctld .ch (SWITch) and the Registrar of Last Resort (RoLR), in order to make sure that the domains will not be available for registration.

Tofsee Domains that have been blocked:

  1. dqgdqg{a..j}.{ch,biz}
  2. dqhdqh{a..j}.{ch,biz}
  3. dqidqi{a..j}.{ch,biz}
  4. dqjdqj{a..j}.{ch,biz}
  5. dqkdqk{a..j}.{ch,biz}
  6. dqldql{a..j}.{ch,biz}
  7. dqmdqm{a..j}.{ch,biz}
  8. dqndqn{a..j}.{ch,biz}
  9. dqodqo{a..j}.{ch,biz}
  10. dqpdqp{a..j}.{ch,biz}
  11. dqqdqq{a..j}.{ch,biz}
  12. dqrdqr{a..j}.{ch,biz}
  13. dqsdqs{a..j}.{ch,biz}
  14. dqtdqt{a..j}.{ch,biz}
  15. dqudqu{a..j}.{ch,biz}
  16. dqvdqv{a..j}.{ch,biz}
  17. dqwdqw{a..j}.{ch,biz}
  18. dqxdqx{a..j}.{ch,biz}
  19. dqydqy{a..j}.{ch,biz}
  20. dqzdqz{a..j}.{ch,biz}
  21. dradra{a..j}.{ch,biz}
  22. drbdrb{a..j}.{ch,biz}
  23. drcdrc{a..j}.{ch,biz}
  24. drddrd{a..j}.{ch,biz}
  25. dredre{a..j}.{ch,biz}
  26. drfdrf{a..j}.{ch,biz}
  27. drgdrg{a..j}.{ch,biz}
  28. drhdrh{a..j}.{ch,biz}
  29. dridri{a..j}.{ch,biz}
  30. drjdrj{a..j}.{ch,biz}
  31. drkdrk{a..j}.{ch,biz}
  32. drldrl{a..j}.{ch,biz}
  33. drmdrm{a..j}.{ch,biz}
  34. drndrn{a..j}.{ch,biz}
  35. drodro{a..j}.{ch,biz}
  36. drpdrp{a..j}.{ch,biz}
  37. drqdrq{a..j}.{ch,biz}
  38. drrdrr{a..j}.{ch,biz}
  39. drsdrs{a..j}.{ch,biz}
  40. drtdrt{a..j}.{ch,biz}
  41. drudru{a..j}.{ch,biz}
  42. drvdrv{a..j}.{ch,biz}
  43. drwdrw{a..j}.{ch,biz}
  44. drxdrx{a..j}.{ch,biz}
  45. drydry{a..j}.{ch,biz}
  46. drzdrz{a..j}.{ch,biz}
  47. dsadsa{a..j}.{ch,biz}
  48. dsbdsb{a..j}.{ch,biz}
  49. dscdsc{a..j}.{ch,biz}
  50. dsddsd{a..j}.{ch,biz}
  51. dsedse{a..j}.{ch,biz}
  52. dsfdsf{a..j}.{ch,biz}

Please spread the word :)

  • RSS
  • Follow by Email
  • Facebook
  • Google+
    http://cyberwarzone.com/swiss-cert-cracked-tofsee-botnet-dga/">