# MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI

DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI](<https://devfeed.tech/articles/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-22543.md>)

Original publisher: [Read original article](<https://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01?source=rss----905ea2b3d4d1---4>)

Author: Jason Reaves

Published: 2026-06-17T21:54:01Z

Content type: article

Language: en

Sources: [Walmart Global Tech](<https://devfeed.tech/sources/walmart-global-tech.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Python](<https://devfeed.tech/topics/python.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [capture](<https://devfeed.tech/tags/capture.md>), [claude](<https://devfeed.tech/tags/claude.md>), [claude-ai](<https://devfeed.tech/tags/claude-ai.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [ip](<https://devfeed.tech/tags/ip.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [port](<https://devfeed.tech/tags/port.md>), [python](<https://devfeed.tech/tags/python.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>)

## AI overview

The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code.

## Source excerpt

By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win