Nah, this was one of the first things you'd notice. No need to reverse the binary, you see the domain in pcaps when you run it.

Registering unregistered domains the malware connects to is a very obvious thing to do, in this case he got "lucky".