<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-malware-command-and-control
description: >-
  Analyze malware command-and-control (C2) infrastructure including protocol
  identification, beacon decryption, traffic pattern analysis, and C2 framework
  fingerprinting.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - command-and-control
  - c2
  - network-analysis
  - beacon
  - cobalt-strike
  - protocol-analysis
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071", "T1573"]
---

# Analyzing Malware Command and Control

## Overview

Command-and-control (C2) channels allow threat actors to remotely control compromised systems. Modern C2 implementations use encrypted HTTPS, DNS tunneling, domain fronting, or protocol-compliant traffic over legitimate services to blend with normal network activity. Analysis involves capturing network traffic, identifying beacon patterns, extracting C2 configuration from malware samples, decrypting communications, and mapping infrastructure to attribute threat actors.

## Prerequisites

- Wireshark / tshark for packet analysis
- Zeek (formerly Bro) for protocol analysis
- RITA (Real Intelligence Threat Analytics) for beacon detection
- JA3/JA3S for TLS fingerprinting
- Fakenet-NG / INetSim for C2 simulation
- Python 3.10+ with `scapy`, `dpkt`, `cryptography`

## Key Concepts

### C2 Communication Patterns

| Pattern | Protocol | Detection Method |
|---------|----------|-----------------|
| HTTP(S) beaconing | TCP/443, TCP/80 | Beacon interval analysis |
| DNS tunneling | UDP/53 | Query length/frequency anomaly |
| Domain fronting | TCP/443 | SNI vs Host header mismatch |
| ICMP tunneling | ICMP | Payload size anomaly |
| Custom protocol | Various | Protocol non-compliance |

### Beacon Analysis

Regular C2 check-ins produce detectable timing patterns. Even jittered beacons show statistical regularity: median inter-arrival times cluster around the configured sleep interval. RITA and similar tools detect these patterns by analyzing session metadata.

## Workflow

### Step 1: Capture C2 Traffic

```bash
# Start network capture during sample execution
tcpdump -i eth0 -w c2_capture.pcap -n "not port 22"

# Simulate network services (before sample execution)
sudo fakenet-ng
# OR
sudo inetsim --data-dir /var/lib/inetsim

# Extract DNS queries from capture
tshark -r c2_capture.pcap -Y "dns.qr==0" -T fields \
    -e dns.qry.name -e ip.src | sort | uniq -c | sort -rn
```

### Step 2: Identify Beacon Patterns

```bash
# RITA beacon analysis
rita import --database malware_traffic c2_capture.pcap
rita show-beacons malware_traffic

# Manual beacon detection with tshark
tshark -r c2_capture.pcap -Y "http.request" -T fields \
    -e frame.time_epoch -e ip.dst -e http.host -e http.request.uri | \
    sort -k2

# Calculate beacon intervals
python3 -c "
import sys
times = []
with open('beacon_times.txt') as f:
    for line in f:
        times.append(float(line.strip()))
intervals = [times[i+1] - times[i] for i in range(len(times)-1)]
avg = sum(intervals) / len(intervals)
jitter = max(intervals) - min(intervals)
print(f'Avg interval: {avg:.1f}s, Jitter: {jitter:.1f}s, Count: {len(intervals)}')
"
```

### Step 3: Extract C2 Configuration from Sample

```bash
# Ghidra — find C2 URLs/IPs in binary
strings -a sample.exe | grep -iE 'https?://|:\d{4,5}|/[a-z]{5,}'

# For Cobalt Strike beacons
python3 -c "
# CobaltStrikeParser
from dissect.cobaltstrike import beacon
b = beacon.BeaconConfig.from_file('beacon.bin')
print(f'C2 Server: {b.protocol}://{b.c2_server}')
print(f'User-Agent: {b.useragent}')
print(f'Sleep: {b.sleeptime}ms, Jitter: {b.jitter}%')
print(f'Watermark: {b.watermark}')
"

# radare2 — find embedded URLs/IPs
r2 -qc 'izz~http' sample.exe
r2 -qc 'izz~\d+\.\d+\.\d+\.\d+' sample.exe
```

### Step 4: Analyze DNS Tunneling

```bash
# Detect DNS tunneling indicators
tshark -r c2_capture.pcap -Y "dns" -T fields \
    -e dns.qry.name -e dns.qry.type -e dns.resp.type | \
    awk -F'\t' '{print length($1), $0}' | sort -rn | head -20

# Long DNS queries (>50 chars) indicate tunneling
tshark -r c2_capture.pcap -Y "dns.qry.name.len > 50" \
    -T fields -e dns.qry.name

# Frequency analysis per domain
tshark -r c2_capture.pcap -Y "dns.qr==0" -T fields -e dns.qry.name | \
    awk -F. '{print $(NF-1)"."$NF}' | sort | uniq -c | sort -rn | head -20
```

### Step 5: TLS Fingerprinting

```bash
# JA3 fingerprint extraction
tshark -r c2_capture.pcap -Y "tls.handshake.type==1" \
    -T fields -e ip.src -e tls.handshake.ja3

# JA3S (server) fingerprint
tshark -r c2_capture.pcap -Y "tls.handshake.type==2" \
    -T fields -e ip.src -e tls.handshake.ja3s

# Compare against known C2 JA3 hashes
# Cobalt Strike default: 72a589da586844d7f0818ce684948eea
# Metasploit Meterpreter: 5d65ea3fb1d4aa7d826733d2f2bf4e88
```

## YARA Rule

```yara
rule Malware_C2_HTTP_Beacon {
    meta:
        description = "Detects HTTP-based C2 beacon configuration patterns"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1071.001"
        severity = "high"
    strings:
        $ua1 = "Mozilla/5.0" ascii
        $uri1 = "/api/v1/" ascii
        $uri2 = "/updates/check" ascii
        $uri3 = "/login.php" ascii
        $b64_config = /[A-Za-z0-9+\/]{40,}={0,2}/ ascii
        $sleep = { C7 45 ?? 00 EA 00 00 }  // mov [ebp+var], 60000 (60sec)
        $xor_key = { 80 34 ?? ?? 48 FF C? }  // XOR decode loop
    condition:
        uint16(0) == 0x5A4D and
        $ua1 and
        any of ($uri*) and
        ($sleep or $xor_key or $b64_config)
}
```

## Detection

```yaml
title: Malware Command And Control Detection
id: 6df226f2-6fd4-4f7b-b486-01589d951a53
status: experimental
description: Detects suspicious activity related to analyzing malware command and control techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*malware*"
  condition: selection
level: high
tags:
  - attack.t1071
  - attack.t1573
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] C2 traffic captured and separated from benign traffic
- [ ] Beacon interval and jitter pattern documented
- [ ] C2 server addresses extracted (IP, domain, URI)
- [ ] Communication protocol identified and decoded
- [ ] TLS fingerprints (JA3/JA3S) recorded
- [ ] C2 framework identified (Cobalt Strike, Metasploit, custom)
- [ ] Infrastructure mapped to MITRE ATT&CK (T1071, T1573, T1572)

## References

- [MITRE ATT&CK T1071 — Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)
- [RITA — Real Intelligence Threat Analytics](https://github.com/activecm/rita)
- [JA3 — TLS Fingerprinting](https://github.com/salesforce/ja3)
- [Cobalt Strike Configuration Extractor](https://github.com/fox-it/dissect.cobaltstrike)
