Archive analysis links extracted EXE to standalone sample by hash and launch
The sandbox unpacked and launched an executable whose SHA-256 matches the separately analyzed file. Matching network destinations connect the reports, while three recorded HTTPS POSTs received 502 responses—not evidence of successful C2 processing.
Three HTTPS POST requests went to three IP addresses on nonstandard ports, using paths that looked like application-management APIs. All three received HTTP 502 responses. What connects those requests to AEDT.zip, an archive whose sandbox report shows an executable being unpacked and launched? The strongest answer is not a shared filename or a malware label. The archive produced an AEDT.exe whose SHA-256 exactly matches the separately analyzed executable that generated the HTTP records.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read