Procedure examples

QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.

The Regin malware platform can use ICMP to communicate between infected computers.

REPTILE can communicate using TLS over raw TCP.

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.

SnappyTCP spawns a reverse TCP shell following an HTTP-based negotiation.

Anchor has used ICMP in C2 communications.

PlugX can be configured to use raw TCP or UDP for command and control.

Some Reaver variants use raw TCP for C2.

Bisonal has used raw sockets for network communication.

Remsec is capable of using ICMP, TCP, and UDP for C2.

KEYPLUG can use TCP and KCP (KERN Communications Protocol) over UDP for C2 communication.

Clambling has the ability to use TCP and UDP for communication.

TSCookie can use ICMP to receive information on the destination server.

Pay2Key has sent its public key to the C2 server over TCP.

Royal establishes a TCP socket for C2 communication using the API `WSASocketW`.

Uroburos can communicate through custom methodologies for UDP, ICMP, and TCP that use distinct sessions to ride over the legitimate protocols.

Metamorfo has used raw TCP for C2.

Spica can use JSON over WebSockets for C2 communications.

Bandook has a command built in to use a raw TCP socket.

The PipeMon communication module can use a custom protocol based on TLS over TCP.

Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.

RARSTONE uses SSL to encrypt its communication with its C2 server.

SDBbot has the ability to communicate with C2 with TCP over port 443.

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.

WellMail can use TCP for C2 communications.

WINDSHIELD C2 traffic can communicate via TCP raw sockets.

Drovorub can use TCP to communicate between its agent and client modules.

MoonWind completes network communication via raw sockets.

HiddenFace can use a custom TCP protocol over Port 443 for C2.

Cryptoistic can use TCP in communications with C2.

LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.

Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.

Samurai can use a proxy module to forward TCP packets to external hosts.

OSX_OCEANLOTUS.D has used a custom binary protocol over port 443 for C2 traffic.

Taidoor can use TCP for C2 communications.

Carbon uses TCP and UDP for C2.

Neo-reGeorg can create multiple TCP connections for a single session.

Some variants of FakeM use SSL to communicate with C2 servers.

MacMa has used a custom JSON-based protocol for its C&C communications.

FunnyDream can communicate with C2 over TCP and UDP.

MOPSLED can use a custom binary protocol over TCP for C2 communication.

LookBack uses a custom binary protocol over sockets for C2 communications.

StealBit can use the Windows Socket networking library to communicate with attacker-controlled endpoints.

The Penquin C2 mechanism is based on TCP and UDP packets.

Winnti for Windows can communicate using custom TCP.

ZIPLINE can communicate with C2 using a custom binary protocol.

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.

Mis-Type network traffic can communicate over a raw socket.

StarProxy has used TCP for C2 communications to target IPs or domains. StarProxy contained code to support both UDP and TCP connections.