Malware Tracker [static + dynamic analysis]

Decode the Binanen Trojan (related to families Graftor or Yayih) GET requests are in the format:
/4025/wxvxwyzxx0/ukwy/vvv7x4vz19A3/kX/.

GET request: