“A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1,”

Sophos · said date not stated · reported 2026-10-23

Sophos detailed the resolver function and fallback DNS logic in the malware sample.