prng-seeded-c2-url-decoding

Technique observed across Go infostealer families (ACR Stealer, Lumma) where C2 URLs, paths, or payloads are decoded at runtime using a math/rand PRNG seeded with hardcoded constants or time-based values.

Mechanism

1. Seed math/rand at startup with composite 64-bit value
2. Generate one or more pseudorandom integers
3. Use generated values as offsets, lengths, or XOR keys against an embedded ciphertext buffer
4. Result is decoded C2 URL or payload configuration

Variants

• Sleep gate variant: PRNG-derived sleep duration (800–1120 s) before any network activity
• String decoder variant: PRNG values used to select substrings from a permutation table

See Also

• acrstealer
• golang-stealer-build-pattern