WinAuthority run requests point to an activity-reporting endpoint
Three sandbox reports show the executable sending the same application-specific request structure with different identifier-like values. A recorded HTTP 200 response in one report supports an exchange, but the evidence does not establish command and control.
WinAuthority.exe sent an HTTP request describing its own activity: action=run, app=winauth and a module version matching the executable’s reported file version. Three sandbox reports captured the same request structure at s.91toolbox.com/winauth, with different identifier-like values. The question is not simply whether the utility contacted an external server, but what that exchange reveals about the server’s role.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read