This is not really my area of expertise so perhaps explains my confusion.
I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but
"but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automatic or manual."
so is the assumption here that they were trying to get just one person, or actually this specific person CuckooExe?
Could it be that the deletion happened because
1. they know infection happened because data sent ?
2. Next stage of infection not happen (whatever that would be) therefore it follows infection detected.
3. delete dns on infection detected?
or am I overthinking this?
I'm not actually getting the domain was taken down reasoning, I mean I understand it was taken down but
"but after using an online NS lookup tool, I realized that the DNS records were deleted some time last night. This must have been in response to the next stage having been downloaded. It’s unclear whether deleting the DNS records was automatic or manual."
so is the assumption here that they were trying to get just one person, or actually this specific person CuckooExe?
Could it be that the deletion happened because
1. they know infection happened because data sent ?
2. Next stage of infection not happen (whatever that would be) therefore it follows infection detected.
3. delete dns on infection detected?
or am I overthinking this?