Dropped-file hashes reveal nested execution behind a shared endpoint
A Wextract-marked executable launched identifiable components from two temporary directories, while its sandbox report recorded traffic to an endpoint found in extracted configurations. The hashes and process parentage clarify the package’s structure, but the traffic record does not identify which process connected.
A Wextract-marked executable launched a program from one temporary directory, which in turn launched executables from another. In the same VMRay sandbox report, TCP traffic went to 185.161.248.73:4164—the exact destination found in extracted configurations for both the original file and one of its hash-identified components. The question is no longer simply whether the file is suspicious, but how its packaging behavior connects to that network destination.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read