Procedure examples

SDBbot has the ability to communicate with C2 with TCP over port 443.

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.

WellMail can use TCP for C2 communications.

WINDSHIELD C2 traffic can communicate via TCP raw sockets.

Drovorub can use TCP to communicate between its agent and client modules.

MoonWind completes network communication via raw sockets.

HiddenFace can use a custom TCP protocol over Port 443 for C2.

Cryptoistic can use TCP in communications with C2.

LunarMail can ping a specific C2 URL with the ID of a victim machine in the subdomain.

Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.

Samurai can use a proxy module to forward TCP packets to external hosts.

OSX_OCEANLOTUS.D has used a custom binary protocol over port 443 for C2 traffic.

Taidoor can use TCP for C2 communications.

Carbon uses TCP and UDP for C2.

Neo-reGeorg can create multiple TCP connections for a single session.

Some variants of FakeM use SSL to communicate with C2 servers.

MacMa has used a custom JSON-based protocol for its C&C communications.

FunnyDream can communicate with C2 over TCP and UDP.

MOPSLED can use a custom binary protocol over TCP for C2 communication.

LookBack uses a custom binary protocol over sockets for C2 communications.

StealBit can use the Windows Socket networking library to communicate with attacker-controlled endpoints.

The Penquin C2 mechanism is based on TCP and UDP packets.

Winnti for Windows can communicate using custom TCP.

ZIPLINE can communicate with C2 using a custom binary protocol.

metaMain can establish an indirect and raw TCP socket-based connection to the C2 server.

Mis-Type network traffic can communicate over a raw socket.

StarProxy has used TCP for C2 communications to target IPs or domains. StarProxy contained code to support both UDP and TCP connections.

ShadowPad has used UDP for C2 communications.

QakBot has the ability use TCP to send or receive C2 packets.

Gelsemium has the ability to use TCP and UDP in C2 communications.

PHOREAL communicates via ICMP for C2.

Lizar has used a raw TCP connection to communicate with the C2 server.

HiddenWasp communicates with a simple network protocol over TCP.

WarzoneRAT can communicate with its C2 server via TCP over port 5200.

FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP.

Brute Ratel C4 has the ability to use TCP for external C2.

Mythic supports WebSocket and TCP-based C2 profiles.

QuasarRAT can use TCP for C2 communication.