SUNBURST

SUNBURST Detection for SUNBURST C2 Stage-1 using Shannon Entropy About: Using Shannon Entropy to detect Domain-Generation Algorithms DGA. It should only be fed FQDNs into the function or read from a CSV file. SYNTAX: Prefixorsubdomain.Domain.TLD Made due to APTs leveraging long-string DGA for Kil...

catphish

CATPHISH Genera dominios de aspecto similar para ataques de phishing. Verifica dominios expirados y su estado de categorización para evadir la categorización de proxies. Los dominios en lista blanca son perfectos para tus servidores C2. Ideal para compromisos de Red Team. Instalación bundle insta...

domain_generation_algorithms

Algoritmos de Generación de Dominios Algoritmos de Generación de Dominios DGAs de malware reimplementados en Python. Resumen banjori también conocido como MultiBanker 2, BankPatcher Enlaces http://johannesbader.ch/2015/02/the-dga-of-banjori/ Dominios de ejemplo earnestnessbiophysicalohax.com...

DGA-Detection

Detección de DGA Cada vez se crea más malware con técnicas avanzadas de evasión de bloqueo. Una de las técnicas más comunes es el uso de Algoritmos de Generación de Dominios DGA, que generan periódicamente un conjunto de dominios para contactar con un servidor C&C. La mayoría de estos dominios DG...

DGA

DGA El repositorio que contiene los algoritmos para generar nombres de dominio, diccionarios de nombres de dominio maliciosos. Desarrollado para investigar la posibilidad de aplicar machine learning y redes neuronales para detectar y clasificar dominios maliciosos. Lista de wordlists alexa.csv...

dga-collection

DGA Collection A collection of known Domain Generation Algorithms: Torpig ZeusBot Cryptolocker Necurs Symmi Ranbyus Usage For each DGA, the list of domains can be easily generated: from datetime import date from Necurs import Necurs Compute domains for the current day/period: Necurs.domains Compu...

Adaptive AI for Detecting Modern DGA Attacks

...

Gravity Falls: A Comparative Analysis of Domain-Generation Algorithm (DGA) Detection Methods for Mobile Device Spearphishing

Mobile devices are frequent targets of eCrime threat actors through SMS spearphishing smishing links that leverage Domain Generation Algorithms DGA to rotate hostile infrastructure. Despite this, DGA research and evaluation largely emphasize malware C2 and email phishing datasets, leaving limited...

Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules for Enhanced Security

Polymorphic malware continually alters its structure to evade signature-based defences, challenging both commercial antivirus AV and enterprise detection systems. This study introduces a reproducible framework for analysing eight polymorphic behaviours-junk code insertion, control-flow obfuscatio...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

EUVD-2025-33277

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

The Web Developer for Chrome extension (version 0.4.9 ) was found to contain malicious code as part of a supply chain compromise. The vulnerability involves a Domain Generation Algorithm (DGA) used to fetch remote scripts that load modules for malvertising , extensive ad substitution, and traffic...

PT-2025-41313

Name of the Vulnerable Software and Affected Versions Web Developer for Chrome versions prior to 0.5.0 Description The Web Developer for Chrome extension contained malicious code that generated a domain using a domain generation algorithm DGA and retrieved a remote script. This script loaded...

Web Developer for Chrome 安全漏洞

Web Developer for Chrome is a browser developer extension by Chris Pederick Personal Developer. A security vulnerability exists in Web Developer for Chrome version 0.4.9, which stems from malicious code that generates a domain name and obtains remote scripts via DGA, which could lead to user-leve...

MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks

The malware loader known as MintsLoader has been used to deliver a PowerShell-based remote access trojan called GhostWeaver. "MintsLoader operates through a multi-stage infection chain involving obfuscated JavaScript and PowerShell scripts," Recorded Future's Insikt Group said in a report shared...

CoffeeLoader Uses GPU-Based Armoury Packer to Evade EDR and Antivirus Detection

Cybersecurity researchers are calling attention to a new sophisticated malware called CoffeeLoader that's designed to download and execute secondary payloads. The malware, according to Zscaler ThreatLabz, shares behavioral similarities with another known malware loader known as SmokeLoader. "The...

ZLoader Malware Returns With DNS Tunneling to Stealthily Mask C2 Comms

Cybersecurity researchers have discovered a new version of the ZLoader malware that employs a Domain Name System DNS tunnel for command-and-control C2 communications, indicating that the threat actors are continuing to refine the tool after resurfacing a year ago. "Zloader 2.9.4.0 adds notable...