Grandoreiro’s DGA uses two strings (prefix and suffix) hardcoded in the binary and the local date as inputs. Note that based on the DGA, a different website is required for each day. We have observed some variants also using a custom base64 alphabet