{
	"id": "71659ba4-74c5-4d41-bb4b-8e076b91f38e",
	"created_at": "2026-07-31T02:02:58.775245Z",
	"updated_at": "2026-10-20T09:15:21.640902Z",
	"deleted_at": null,
	"sha1_hash": "498225ab28d6ef8d2f5aa23c0c8888513cb23cc2",
	"title": "MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1066791,
	"plain_text": "https://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nMetaStealer traffic, new DGAs and analyzing the “tracker”\n\nbackdoor DGA with AI\n\nBy Jason Reaves\n\nPublished: 2026-06-17 · Archived: 2026-07-31 02:01:43 UTC\n\n5 min read\n\nJun 17, 2026\n\nBy: Jason Reaves and Joshua Platt\n\nIn this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a\n\nnew wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’\n\ndon’t actually care what domain gets used as it’s just a config item; they simply pass on the traffic to another\n\nserver.\n\nWe also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears\n\nto still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality.\n\nLeveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the\n\nDGA used in the backdoor malware and provide working python code to simulate it.\n\nMetaStealer DGA:\n\nAs previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples:\n\nsea-vast-send.com\n46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0\n\nhxxp:\nd57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96\n\nhxxp:\nd1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5\n\nThis does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has\n\ndesigned their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP\n\naddress, port, URI, and HTTP headers are the more important factors.\n\nPage 1 of 7\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\n155.117.20.75\nqocyeicmusmegouw.xyz\n\n213.139.77.254\nuumcceymkuymmqou.xyz\n\nWe didn’t focus on this DGA though because during our investigation we stumbled on a piece of malware being\n\nactively developed by the same TA that also had a DGA.\n\nBackdoor “tracker”\n\nDuring the investigation, we observed a peculiar payload being delivered to several machines: an installer named\n\nRuntimeSync, example hash:\n\n82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141\n\nRuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Windows\n\nThis file identifies itself as a “RuntimeSync Agent” and explicitly refers to itself as a “tracker.” It contains a broad\n\nrange of functionality, including:\n\nDesktop video capture\n\nKeylogging\n\nSelf-updating\n\nFile uploads\n\nScreenshot capture\n\nRemote command execution\n\nA Domain Generation Algorithm (DGA)\n\nThe binary is largely unobfuscated, which made it relatively straightforward to analyze. As an experiment, I\n\ndecided to let Claude handle the DGA analysis by systematically guiding it through the relevant subroutines. Once\n\nit had produced an initial implementation, I supplied known-good output samples, allowing it to identify and\n\ncorrect its own mistakes.\n\nGet Jason Reaves’s stories in your inbox\n\nJoin Medium for free to get updates from this writer.\n\nRemember me for faster sign in\n\nThe DGA is relatively easy to identify within the binary, as it begins by preparing a word list:\n\nPress enter or click to view image in full size\n\nPage 2 of 7\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nAfterwords what looks like a seed and a domain count along with a TLD is passed to a function that will utilize\n\nthe parsed list:\n\nMy approach was to provide Claude with the main DGA\n\nand supporting functions as the session went on:\n\nPress enter or click to view image in full size\n\nroutine of sub_140006F10 and then provide sub routines\n\nPage 3 of 7\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nRight off the bat it was able to identify this was a routine that was generating strings based on a list of tokens,\n\neven determining this was probably a DGA\n\n\u003e **Key insight:** This is a **DGA (Domain Generation Algorithm)** — the pattern of `hash % node_pool\n\nn suffix) is a classic DGA structure used in malware to generate pseudorandom C2 domain names from a\n\nAfter getting through a few standard helper functions such as an allocator and some vector routines I went back to\n\nthe word list before the DGA was called:\n\nThis is the **word list tokeniser** that splits the raw comma-separated string into the `NodeVector`\n\n**Logic:**\n\n- Iterates character by character, accumulating into a buffer\n\n- On comma (`ASCII 44`): trims leading (`space`, `tab`) and trailing (`space`, `tab`, `\\r`, `\\n`) whi\n\n- After loop: flushes the final token (no trailing comma in the list) via `sub_140005AD0`\n\n---\n\nCulminating in giving the AI the disassembly of the function responsible for calling the DGA routine:\n\nThis is the **top-level entry point** that wires everything together.\n\nPage 4 of 7\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\n**Hardcoded constants extracted:**\n\n| Constant | Value | Meaning |\n\n|---|---|---|\n\n| `seed` | `0x1AED` (6893) | Initial hash value |\n\n| `levels` | `1000` | Domains to generate |\n\n| `width` | `3` | Words per domain |\n\n| `TLD` | `\"com\"` | Hardcoded suffix at address `8026488` |\n\n| Word pool | 101 words | Space/tech themed, comma-separated |\n\n**Word list:**\n\n```\n\nvoid, star, orbit, probe, moon, sun, core, crust, dust, gas, rock, ice, ring,\n\ndisc, belt, flare, ray, beam, light, dark, cold, heat, mass, weight, force,\n\npull, push, drift, glide, spin, tilt, axis, pole, cap, crater, ridge, peak,\n\nrift, vent, plume, cloud, mist, fog, veil, spark, flash, glow, pulse, wave,\n\ntide, flow, stream, path, track, zone, rim, edge, brink, shell, skin, hull,\n\nhatch, port, bay, dock, deck, mast, sail, wing, fin, nose, tail, tank, fuel,\n\nbolt, nut, wire, cord, link, joint, gear, lens, glass, mirror, film, chip,\n\ngrid, plug, switch, knob, dial, screen, frame, base, stand, mount, arm, dish,\n\nbeam, mast, boom\n\n```\n\n**Steps:**\n\n1. Sets status flag `*a2 = 1`\n\n2. Allocates 544 bytes and copies in the 528-char word string\n\n3. Calls `sub_140007B50` to parse it into a `NodeVector`\n\n4. Calls `sub_140006F10(a1, 0x1AED, 1000, 3, \u0026Block, Src)` — the DGA\n\n5. Cleans up all allocations\n\nHowever, the code generated by the AI did not produce the same domains as the malware. T\n\nissue, I provided the first three expected domains generated by the sample and informed the\n\nimplementation contained a bug.\n\nPress enter or click to view image in full size\n\nPage 5 of 7\n\no help identify the\n\nAI that its\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nNot only did it discover the bug to let it generate the domains correctly but it also discovered another bug that had\n\nto do with edge cases.\n\nThe final generated python code aligned correctly with the desired output:\n\nFirst 10 domains:\n\n1. lensclouddisc.xyz\n\n2. drift-joint-axis.xyz\n\n3. flow-pull-edge.xyz\n\n4. crust-noseweight.xyz\n\n5. zone-void-ray.xyz\n\n6. beammastvoid.xyz\n\n7. stand-cap-heat.xyz\n\n8. flashmountaxis.xyz\n\n9. edge-arm-deck.xyz\n\n10. jointpeakbolt.xyz\n\nAI is advancing rapidly in the reverse engineering space. Although it still requires an experienced practitioner to\n\nguide the analysis and verify the output, this example highlights the pace at which the technology is improving\n\nand suggests that its role in malware analysis will continue to grow.\n\nIOCs\n\nMetastealer:\n\nPage 6 of 7\n\nhttps://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nNetwork:\n\nUser-Agent: cpp-httplib/0.12.1\n\nURIs:\n\n/tasks/get_worker\n\n/api/client_hello\n\n/tasks/collect\n\n/api/client/new\n\n/api/client/init\n\n/avast_update\n\n/api/client/verify\n\nBackdoor “tracker”:\n\nNetwork:\n\nUser-Agent: RuntimeSync-Updater/1.0\n\n/pmxs/logs?token=\u003cGUID\u003e\n\nEndpoint:\n\n\\Microsoft\\RuntimeSync\n\n\\Microsoft\\RuntimeSync\\last_domain.txt\n\n\\Microsoft\\RuntimeSync\\agent.token\n\nSource: https://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01\n\nPage 7 of 7",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01"
	],
	"report_names": [
		"metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01"
	],
	"threat_actors": [],
	"ts_created_at": 1785463378,
	"ts_updated_at": 1792487721,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/498225ab28d6ef8d2f5aa23c0c8888513cb23cc2.pdf",
		"text": "https://archive.orkl.eu/498225ab28d6ef8d2f5aa23c0c8888513cb23cc2.txt",
		"img": "https://archive.orkl.eu/498225ab28d6ef8d2f5aa23c0c8888513cb23cc2.jpg"
	}
}