Matching POST requests link two hosts in an installer workflow
A sandbox report records POST requests to two subdomains using the same path and matching query parameters, alongside temporary setup executables and a separate request for software on S3. The pairing supports an installer-associated communications role, but the reports do not reveal what data was exchanged or show that either host delivered software or issued commands.
Two hosts, os.baixakialtcdn.com and os2.baixakialtcdn.com, appear in a sandbox report with an unusually specific connection: each was addressed by HTTP POST requests using the same path and matching query parameters. The report also records temporary setup executables, a command with a progress-display argument, and a request for an executable hosted on Amazon S3. What role did the paired hosts play in that activity?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read