Configured C2 Host Matches Sandbox DNS and Traffic, Not a Proven Session
A Windows executable’s configuration names sa1atik.cn as a C2 endpoint, and a sandbox report records its DNS answer and TCP traffic to one returned address on the configured port. That corroborates the route at the DNS and transport layers, but does not show a request to /sa1at/ or a successful command exchange.
A Windows executable’s memory-derived configuration names https://sa1atik.cn/sa1at/ as a command-and-control endpoint. In a CAPE sandbox report for the same file, that hostname resolves to two addresses, one of which also appears as a TCP destination on port 443. The relationship raises a more useful question than whether the domain has a malicious reputation: how much of the configured communication route is visible in execution evidence?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read