When executed in a sandbox, we observed it connecting to a command & control (C&C) server at newrat2.noip.org on TCP port 1604. The RAT uses a raw TCP protocol to exchange information with its C&C; on the wire, the