Domain Generation Algorithms

Subtechnique · ATTACK:mobile:T1637.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1637.001",
  "title": "Domain Generation Algorithms",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1637/001",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--fd211238-f767-4599-8c0d-9dca36624626",
  "external_id": "T1637.001",
  "domain": "mobile",
  "created": "2022-04-05T19:59:03.161Z",
  "modified": "2025-10-24T17:49:39.530Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Data Driven Security DGA",
      "url": "https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/"
    },
    {
      "source_name": "securelist rotexy 2018",
      "url": "https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.