Configured C2 address also appears in a separate sample’s HTTP POST
A sandbox recorded an HTTP POST to a URL listed as C2 in a different executable’s extracted configuration. DNS and TCP observations in the POST report reinforce that it was a request destination, but the records do not link the files into one execution chain or show a successful C2 exchange.
A sandbox recorded an HTTP POST to http://host-host-file8.com/, a URL also identified as a command-and-control endpoint in configuration extracted from a different executable. That overlap raises a concrete question: was the address merely present in malware configuration, or did an analyzed program actually use it? The records supplied to CTX Threat Intelligence support the latter, at the level of the sandbox report.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read