ProRAM C2 origin binding via HTTP redirect to hardcoded IP 20.187.77.65

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.