DGA

DGA المستودع الذي يحتوي على الخوارزميات لتوليد أسماء النطاقات، وقواميس أسماء النطاقات الضارة. طُوّر للبحث في إمكانية تطبيق تعلّم الآلة والشبكات العصبية لكشف وتصنيف النطاقات الضارة. قائمة قوائم الكلمات alexa.csv alexa top million opendns-top-domains.txt a few dns domain's from opendns zeus.txt...

catphish

CATPHISH توليد نطاقات مشابهة لهجمات التصيد. التحقق من النطاقات المنتهية صلاحيتها وحالة تصنيفها لتجنب تصنيف الوكيل. النطاقات المدرجة في القائمة البيضاء مثالية لخوادم C2 الخاصة بك. مثالية لمهام الفريق الأحمر. التثبيت bundle install الخوارزميات الحالية SingularOrPluralise prependOrAppend...

DGA-Detection

DGA-Detection More and more malware is being created with advanced blocking circumvention techniques. One of the most prevalent techniques being used is the use of Domain Generation Algorithms which periodically generates a set of Domains to contact a C&C server. The majority of these DGA domains...

dga-collection

مجموعة DGA مجموعة من خوارزميات توليد النطاقات المعروفة: Torpig ZeusBot Cryptolocker Necurs Symmi Ranbyus الاستخدام لكل DGA، يمكن توليد قائمة النطاقات بسهولة: from datetime import date from Necurs import Necurs Compute domains for the current day/period: Necurs.domains Compute domains for a given...

SUNBURST

SUNBURST كشف المرحلة الأولى من SUNBURST C2 باستخدام إنتروبيا شانون حول: استخدام إنتروبيا شانون للكشف عن خوارزميات توليد النطاقات DGA. يجب إدخال أسماء النطاقات المؤهلة بالكامل FQDN فقط في الدالة أو قراءتها من ملف CSV. الصيغة: Prefixorsubdomain.Domain.TLD أُنشئ بسبب استغلال الجهات الفاعلة المتقدمة...

domain_generation_algorithms

Algorithmes de génération de domaines Algorithmes de génération de domaines DGA de logiciels malveillants réimplémentés en Python. Aperçu banjori alias MultiBanker 2, BankPatcher Liens http://johannesbader.ch/2015/02/the-dga-of-banjori/ Exemples de domaines earnestnessbiophysicalohax.com...

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things IoT botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model LLM, albeit with not so successful results. "While the AI complied with...

Adaptive AI for Detecting Modern DGA Attacks

...

Gravity Falls: A Comparative Analysis of Domain-Generation Algorithm (DGA) Detection Methods for Mobile Device Spearphishing

Mobile devices are frequent targets of eCrime threat actors through SMS spearphishing smishing links that leverage Domain Generation Algorithms DGA to rotate hostile infrastructure. Despite this, DGA research and evaluation largely emphasize malware C2 and email phishing datasets, leaving limited...

Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules for Enhanced Security

Polymorphic malware continually alters its structure to evade signature-based defences, challenging both commercial antivirus AV and enterprise detection systems. This study introduces a reproducible framework for analysing eight polymorphic behaviours-junk code insertion, control-flow obfuscatio...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202

The Web Developer for Chrome extension (version 0.4.9 ) was found to contain malicious code as part of a supply chain compromise. The vulnerability involves a Domain Generation Algorithm (DGA) used to fetch remote scripts that load modules for malvertising , extensive ad substitution, and traffic...

EUVD-2025-33277

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

CVE-2017-20202 Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...

PT-2025-41313

Name of the Vulnerable Software and Affected Versions Web Developer for Chrome versions prior to 0.5.0 Description The Web Developer for Chrome extension contained malicious code that generated a domain using a domain generation algorithm DGA and retrieved a remote script. This script loaded...

Web Developer for Chrome 安全漏洞

Web Developer for Chrome is a browser developer extension by Chris Pederick Personal Developer. A security vulnerability exists in Web Developer for Chrome version 0.4.9, which stems from malicious code that generates a domain name and obtains remote scripts via DGA, which could lead to user-leve...

MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks

The malware loader known as MintsLoader has been used to deliver a PowerShell-based remote access trojan called GhostWeaver. "MintsLoader operates through a multi-stage infection chain involving obfuscated JavaScript and PowerShell scripts," Recorded Future's Insikt Group said in a report shared...

CoffeeLoader Uses GPU-Based Armoury Packer to Evade EDR and Antivirus Detection

Cybersecurity researchers are calling attention to a new sophisticated malware called CoffeeLoader that's designed to download and execute secondary payloads. The malware, according to Zscaler ThreatLabz, shares behavioral similarities with another known malware loader known as SmokeLoader. "The...