If it was malware, I would be looking for a malware analysis on one of the malware detection / threat sites. At very least I would expect such a write-up on a

If it was malware, I would be looking for a malware analysis on one of the malware detection / threat sites. At very least I would expect such a write-up on a security analysts blog, that is referenced by a security company. If the code itself is not malware and is being used as command and control, then I would expect someone has captured it being used in this manor and could show the questionable system calls being made.