dllhost.exe reverse TCP to hardcoded IP 8.218.65.184:41397 without prior DNS

Suraj A@cytech

•updated 4 days ago•0•0•1

Detects dllhost.exe making an outbound TCP connection to a public IP on a high port without a preceding DNS lookup on the device shortly before. Also checks for known C2 server connections.