Three configured domains overlap with Remcos network alerts at the IP level
A Windows executable lists eleven distinct domains in its extracted C2 configuration, but only three have recorded DNS addresses matching destinations in Remcos-related network alerts. The matches strengthen the link between configuration and reported traffic without proving which hostnames were used or whether a C2 session succeeded.
Three port-443 destinations in a Windows executable’s network alerts also appear in DNS records for domains listed in its extracted command-and-control configuration. That overlap raises a more useful question than whether the domains look suspicious: how much of the file’s configured network has evidence of actual use? CTX Threat Intelligence’s records connect the executable to eleven distinct configured domains, spanning names under africa.com, hk.com, radio.am and .blog.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read