Configured RedLine endpoint also appears in outbound and response alerts
The same IP and port appear in an executable’s extracted C2 configuration and in directional network detections associated with the file. Related host events record temporary executable creation and attempts to change Defender policy, though they do not establish which process generated the traffic.
The same address appears on both sides of network alerts associated with a Windows executable: 83.97.73.131:19071 is a destination in outbound detections and a source in response detections. The executable’s extracted configuration names that exact IP and port as command-and-control infrastructure. Together, those observations raise a more useful question than whether the address has a malicious reputation: what activity can actually be connected to it?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read