Skip to content

Domain Generation Algorithm

Named by 3 kept items in this workspace.

Search every workspace for Domain Generation Algorithm. It matches the name as written, so it can find other things that share it.

The items that name it 3

  • Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
    writeup2026-06-16It is written here as Domain Generation Algorithm (DGA).

    Deterministic XorShift32-based generator (seed 151678 in Potemkin, 0xDEADBEEF default in RMMProject) picks three words from a 1,000-word dictionary plus optional dashes and .xyz TLD to produce 10,000 candidate C2 domains, probed via GET /api/client_hello checking for 'ok' in response.

  • Dissecting CrashFix: KongTuke's New Toy
    writeup2026-01-16It is written here as Domain Generation Algorithm (DGA).

    Weekly-seeded DGA (seed = (current week of year + 2024) * 789684, later variant using DayOfYear) generates 10 domains per week/day for C2 resilience; malware cycles through domains until one responds.

  • PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
    writeup2025-12-10It is written here as Domain Generation Algorithm (DGA).

    PeerBlight derives a DGA seed via SHA-256 hashing of a fixed date string, Mersenne Twister PRNG seeded from the hash, selecting words from embedded verb/noun dictionaries to generate up to 200 domain:port fallback combinations across 18 TLDs.

All techniques in this workspace.