SUNBURST

SUNBURST Обнаружение C2 Stage-1 SUNBURST с использованием энтропии Шеннона О программе: Использование энтропии Шеннона для обнаружения алгоритмов генерации доменов DGA. В функцию должны подаваться только FQDN либо считываться из CSV-файла. Синтаксис: Prefixorsubdomain.Domain.TLD Создано из-за...

domain_generation_algorithms

Алгоритмы генерации доменов Алгоритмы генерации доменов DGA вредоносных программ, перереализованные на Python. Обзор banjori также известный как MultiBanker 2, BankPatcher Ссылки http://johannesbader.ch/2015/02/the-dga-of-banjori/ Примеры доменов earnestnessbiophysicalohax.com...

dga-collection

DGA-Sammlung Eine Sammlung bekannter Domain-Generierungsalgorithmen: Torpig ZeusBot Cryptolocker Necurs Symmi Ranbyus Verwendung Für jeden DGA kann die Liste der Domains einfach erzeugt werden: root@kitploit: from datetime import date from Necurs import Necurs Compute domains for the current...

DGA-Detection

DGA-Detection Sempre più malware viene creato con tecniche avanzate di elusione dei blocchi. Una delle tecniche più diffuse è l'uso di Domain Generation Algorithms DGA che generano periodicamente un insieme di domini per contattare un server C&C. La maggior parte di questi domini DGA genera...

DGA

DGA Il repository che contiene gli algoritmi per la generazione di nomi di dominio e i dizionari di nomi di dominio dannosi. Sviluppato per studiare la possibilità di applicare l'apprendimento automatico e le reti neurali per rilevare e classificare i domini dannosi. Elenco delle wordlist alexa.c...

catphish

CATPHISH Gere domínios com aparência semelhante para ataques de phishing. Verifique domínios expirados e seu status de categorização para evitar a categorização de proxies. Domínios na lista de permissões são perfeitos para seus servidores C2. Perfeito para engajamentos de Red Team. Instalação...

Adaptive AI for Detecting Modern DGA Attacks

...

Gravity Falls: A Comparative Analysis of Domain-Generation Algorithm (DGA) Detection Methods for Mobile Device Spearphishing

Mobile devices are frequent targets of eCrime threat actors through SMS spearphishing smishing links that leverage Domain Generation Algorithms DGA to rotate hostile infrastructure. Despite this, DGA research and evaluation largely emphasize malware C2 and email phishing datasets, leaving limited...

Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules for Enhanced Security

Polymorphic malware continually alters its structure to evade signature-based defences, challenging both commercial antivirus AV and enterprise detection systems. This study introduces a reproducible framework for analysing eight polymorphic behaviours-junk code insertion, control-flow obfuscatio...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

EUVD-2025-33277

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

Web Developer for Chrome extension v0.4.9 contained malicious code that generated a domain via a domain-generation algorithm (DGA) and fetched a remote script. The script loaded follow-on modules to perform extensive ad substitution and malvertising, displayed fake “repair” alerts redirecting use...

PT-2025-41313

Name of the Vulnerable Software and Affected Versions Web Developer for Chrome versions prior to 0.5.0 Description The Web Developer for Chrome extension contained malicious code that generated a domain using a domain generation algorithm DGA and retrieved a remote script. This script loaded...

Web Developer for Chrome 安全漏洞

Web Developer for Chrome is a browser developer extension by Chris Pederick Personal Developer. A security vulnerability exists in Web Developer for Chrome version 0.4.9, which stems from malicious code that generates a domain name and obtains remote scripts via DGA, which could lead to user-leve...

MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks

The malware loader known as MintsLoader has been used to deliver a PowerShell-based remote access trojan called GhostWeaver. "MintsLoader operates through a multi-stage infection chain involving obfuscated JavaScript and PowerShell scripts," Recorded Future's Insikt Group said in a report shared...

CoffeeLoader Uses GPU-Based Armoury Packer to Evade EDR and Antivirus Detection

Cybersecurity researchers are calling attention to a new sophisticated malware called CoffeeLoader that's designed to download and execute secondary payloads. The malware, according to Zscaler ThreatLabz, shares behavioral similarities with another known malware loader known as SmokeLoader. "The...

ZLoader Malware Returns With DNS Tunneling to Stealthily Mask C2 Comms

Cybersecurity researchers have discovered a new version of the ZLoader malware that employs a Domain Name System DNS tunnel for command-and-control C2 communications, indicating that the threat actors are continuing to refine the tool after resurfacing a year ago. "Zloader 2.9.4.0 adds notable...