By: Jason Reaves and Joshua Platt
In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain gets used as it’s just a config item; they simply pass on the traffic to another server.
We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it.
MetaStealer DGA:
As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples:
sea-vast-send.com
46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0
hxxp://pestrear-lamp.xyz:443
d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96
hxxp://anus-staylard.xyz:443
d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5
This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors.
155.117.20.75
qocyeicmusmegouw.xyz
213.139.77.254
uumcceymkuymmqou.xyz
We didn’t focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA.
Backdoor “tracker”
During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash:
82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141
RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Windows
This file identifies itself as a “RuntimeSync Agent” and explicitly refers to itself as a “tracker.” It contains a broad range of functionality, including:
- Desktop video capture
- Keylogging
- Self-updating
- File uploads
- Screenshot capture
- Remote command execution
- A Domain Generation Algorithm (DGA)
The binary is largely unobfuscated, which made it relatively straightforward to analyze. As an experiment, I decided to let Claude handle the DGA analysis by systematically guiding it through the relevant subroutines. Once it had produced an initial implementation, I supplied known-good output samples, allowing it to identify and correct its own mistakes.
The DGA is relatively easy to identify within the binary, as it begins by preparing a word list:
Afterwords what looks like a seed and a domain count along with a TLD is passed to a function that will utilize the parsed list:
My approach was to provide Claude with the main DGA routine of sub_140006F10 and then provide sub routines and supporting functions as the session went on:
Right off the bat it was able to identify this was a routine that was generating strings based on a list of tokens, even determining this was probably a DGA
> **Key insight:** This is a **DGA (Domain Generation Algorithm)** — the pattern of `hash % node_pool` → label selections joined with `-`, terminated with `.suffix` (a TLD or domai
n suffix) is a classic DGA structure used in malware to generate pseudorandom C2 domain names from a seed.
After getting through a few standard helper functions such as an allocator and some vector routines I went back to the word list before the DGA was called:
## Function 6: `sub_140007B50` — Comma-Separated Word List Parser
### Analysis
This is the **word list tokeniser** that splits the raw comma-separated string into the `NodeVector`.
**Logic:**
- Iterates character by character, accumulating into a buffer
- On comma (`ASCII 44`): trims leading (`space`, `tab`) and trailing (`space`, `tab`, `\r`, `\n`) whitespace, then pushes token if non-empty
- After loop: flushes the final token (no trailing comma in the list) via `sub_140005AD0`
---
Culminating in giving the AI the disassembly of the function responsible for calling the DGA routine:
## Function 7: `sub_14000BF00` — DGA Bootstrap / Top-Level Entry Point
### Analysis
This is the **top-level entry point** that wires everything together.
**Hardcoded constants extracted:**
| Constant | Value | Meaning |
|---|---|---|
| `seed` | `0x1AED` (6893) | Initial hash value |
| `levels` | `1000` | Domains to generate |
| `width` | `3` | Words per domain |
| `TLD` | `"com"` | Hardcoded suffix at address `8026488` |
| Word pool | 101 words | Space/tech themed, comma-separated |
**Word list:**
```
void, star, orbit, probe, moon, sun, core, crust, dust, gas, rock, ice, ring,
disc, belt, flare, ray, beam, light, dark, cold, heat, mass, weight, force,
pull, push, drift, glide, spin, tilt, axis, pole, cap, crater, ridge, peak,
rift, vent, plume, cloud, mist, fog, veil, spark, flash, glow, pulse, wave,
tide, flow, stream, path, track, zone, rim, edge, brink, shell, skin, hull,
hatch, port, bay, dock, deck, mast, sail, wing, fin, nose, tail, tank, fuel,
bolt, nut, wire, cord, link, joint, gear, lens, glass, mirror, film, chip,
grid, plug, switch, knob, dial, screen, frame, base, stand, mount, arm, dish,
beam, mast, boom
```
**Steps:**
1. Sets status flag `*a2 = 1`
2. Allocates 544 bytes and copies in the 528-char word string
3. Calls `sub_140007B50` to parse it into a `NodeVector`
4. Calls `sub_140006F10(a1, 0x1AED, 1000, 3, &Block, Src)` — the DGA
5. Cleans up all allocations
However, the code generated by the AI did not produce the same domains as the malware. To help identify the issue, I provided the first three expected domains generated by the sample and informed the AI that its implementation contained a bug.
Not only did it discover the bug to let it generate the domains correctly but it also discovered another bug that had to do with edge cases.
The final generated python code aligned correctly with the desired output:
First 10 domains:
1. lensclouddisc.xyz
2. drift-joint-axis.xyz
3. flow-pull-edge.xyz
4. crust-noseweight.xyz
5. zone-void-ray.xyz
6. beammastvoid.xyz
7. stand-cap-heat.xyz
8. flashmountaxis.xyz
9. edge-arm-deck.xyz
10. jointpeakbolt.xyz
AI is advancing rapidly in the reverse engineering space. Although it still requires an experienced practitioner to guide the analysis and verify the output, this example highlights the pace at which the technology is improving and suggests that its role in malware analysis will continue to grow.
IOCs
Metastealer:
Network:
User-Agent: cpp-httplib/0.12.1
URIs:
/tasks/get_worker
/api/client_hello
/tasks/collect
/api/client/new
/api/client/init
/avast_update
/api/client/verify
Backdoor “tracker”:
Network:
User-Agent: RuntimeSync-Updater/1.0
/pmxs/logs?token=<GUID>
Endpoint:
\Microsoft\RuntimeSync
\Microsoft\RuntimeSync\last_domain.txt
\Microsoft\RuntimeSync\agent.token
MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI was originally published in Walmart Global Tech Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.