<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Malware C2 — API Reference

## Wireshark / tshark

### C2 Traffic Filters

```bash
# HTTP C2 requests
tshark -r capture.pcap -Y "http.request" -T fields \
    -e frame.time -e ip.src -e ip.dst -e http.host -e http.request.uri

# DNS queries
tshark -r capture.pcap -Y "dns.qr==0" -T fields \
    -e dns.qry.name -e dns.qry.type

# TLS Client Hello (JA3 source)
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e ip.dst -e tls.handshake.extensions_server_name

# Beaconing detection — connection intervals
tshark -r capture.pcap -Y "ip.dst==10.0.0.1 and tcp.flags.syn==1" \
    -T fields -e frame.time_epoch
```

## RITA (Real Intelligence Threat Analytics)

```bash
rita import --database analysis capture.pcap
rita show-beacons analysis            # Beacon detection
rita show-long-connections analysis   # Long-lived connections
rita show-dns analysis                # DNS analysis
rita show-exploded-dns analysis       # DNS tunneling indicators
rita html-report analysis report/     # HTML report
```

## Zeek (Bro)

```bash
zeek -r capture.pcap                # Process PCAP
# Output files: conn.log, dns.log, http.log, ssl.log, x509.log

# Beacon detection from conn.log
cat conn.log | zeek-cut id.orig_h id.resp_h duration | \
    sort -k1,2 | awk '{print $1, $2, $3}'
```

## JA3/JA3S Fingerprinting

```bash
# Extract JA3 hashes
tshark -r capture.pcap -Y "tls.handshake.type==1" -T fields \
    -e ip.src -e tls.handshake.ja3

# JA3 lookup
curl "https://ja3er.com/search/72a589da586844d7f0818ce684948eea"
```

### Known C2 JA3 Hashes

| Hash | Framework |
|------|-----------|
| `72a589da586844d7f0818ce684948eea` | Cobalt Strike (default) |
| `5d65ea3fb1d4aa7d826733d2f2bf4e88` | Metasploit Meterpreter |
| `e7d705a3286e19ea42f587b344ee6865` | Havoc C2 |

## Fakenet-NG / INetSim

```bash
# Fakenet-NG — simulate all network services
sudo fakenet-ng

# INetSim — configurable service simulation
sudo inetsim --data-dir /var/lib/inetsim
# Simulates: DNS, HTTP, HTTPS, FTP, SMTP, IRC, etc.
```

## CobaltStrike Parser

```python
from dissect.cobaltstrike import beacon

config = beacon.BeaconConfig.from_file("beacon.bin")
print(f"C2: {config.c2_server}")
print(f"Port: {config.port}")
print(f"Sleep: {config.sleeptime}")
print(f"Jitter: {config.jitter}")
print(f"User-Agent: {config.useragent}")
print(f"Watermark: {config.watermark}")
```
