Configured C2 addresses appear in sandbox traffic, but outcomes remain unclear
Sandbox reports show traffic to several destinations recovered from a Windows executable’s configuration, including an HTTP POST that received a 404 response. The overlap shows the addresses were more than a dormant list, but does not establish successful command delivery or data theft.
An HTTP POST in a Windows executable’s sandbox report targeted an IP address also recovered from its memory-based configuration. The recorded response was 404. In another sandbox report, TCP traffic matched four more configured destinations. Together, these observations raise a more useful question than whether the file contains suspicious addresses: which of those addresses were used during analysis, and what did that use accomplish?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read