Sandbox reports trace executable’s request to configuration-shaped URL
Two sandbox reports show the same Windows executable requesting a specific resource at udo.jxwan.com and resolving the host to the same two IP addresses. One records an HTTP 200 response, but neither reveals the returned content or shows that it drove the executable’s local activity.
Two sandbox reports record a Windows executable requesting the same resource: http://udo.jxwan.com/index/getcfg?id=59522. Both resolve the hostname to the same pair of IP addresses, and one records an HTTP 200 response. The request raises a more useful question than whether the destination appears on a threat list: what role did this service actually play in the executable’s behavior?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read