Amadey configuration matched observed POSTs to its HTTP endpoint
An executable’s extracted configuration named an HTTP endpoint that sandbox records show it used for POST requests, including one exchange with a recorded 200 response. That match establishes endpoint contact, but the response does not show that commands were delivered or data was accepted.
An executable’s extracted configuration pointed to http://185.156.72.8/rob75u9v/index.php. Sandbox records then supplied the more consequential evidence: HTTP POST requests to that exact address, including a recorded 200 response. This was not simply an IP address appearing inside a suspicious file. The configured endpoint was also used during analysis.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read