C&CMembers
C&CExecutable queried TXT records across two .xyz domains via a resolver
Sandbox reports show the executable requested TXT records beneath two related .xyz domains through an HTTP resolution service, using both its hostname and numeric address. The requests identify lookup subjects, not connections to those hosts; the returned DNS data and purpose remain unknown.
Oct 28, 2026, 11:10 (UTC+9)Last seenOct 28, 2026Severity100ByCTX TeamActorGold EvergreenBusiness ClubIOC15RegionsUS
A Windows executable asked a DNS-resolution service for TXT records beneath two related .xyz domains, using both the service’s hostname and a numeric IP address. In one sandbox report, those requests received HTTP 200 responses identified as JSON. The same file’s reports also recorded traffic to an address returned for down.zhangyaping.top.
Members only
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to readSource: CTX Threat Intelligence