Configured domains appear in POST requests, alongside local file changes
The sample’s two configured domains appear in reported HTTPS POST requests, while separate sandbox evidence links a file suffix to README files, an icon and Windows file associations. Together, the records show communication attempts and coordinated local artifacts, but not a completed command exchange or a dependency between the network and host activity.
A Windows executable contacted two domains named in its extracted configuration, while a separate sandbox report tied an unusual file suffix to README files, an icon and Windows file-association settings. Those observations raise a more useful question than whether the sample is malicious: how do its outward communications relate to the changes it makes locally? The records examined by CTX Threat Intelligence support two complementary roles.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read