Procedure examples

FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.

NGLite will initially beacon out to the NKN network via an HTTP POST over TCP 30003.

The Carbanak malware communicates to its command server using HTTP with an encrypted payload.

CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.

Elise communicates over HTTP or HTTPS for C2.

Gazer communicates with its C2 servers over HTTP.

TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.

Latrodectus can send registration information to C2 via HTTP `POST`.

Saint Bot has used HTTP for C2 communications.

Chaes has used HTTP for C2 communications.

CharmPower can use HTTP to communicate with C2.

MuddyViper has used HTTP GET requests over port 443 and with the WINHTTP_FLAG_SECURE set to SSL/TLS via the WinHTTP API.

3PARA RAT uses HTTP for command and control.

Bundlore uses HTTP requests for C2.

SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.

Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.

QUADAGENT uses HTTPS and HTTP for C2 communications.

Sagerunex communicates via HTTPS, at times using a hard-coded User Agent of `Mozilla/5.0 (compatible; MSIE 7.0; Win32)`.

Sys10 uses HTTP for C2.

pngdowner uses HTTP for command and control.

GlassWorm has used HTTP for C2 and extracts data from the HTTP response headers.

Uroburos can use a custom HTTP-based protocol for large data communications that can blend with normal network traffic by riding on top of standard HTTP.

Metamorfo has used HTTP for C2.

Trojan.Karagany can communicate with C2 via HTTP POST requests.

MagicRAT uses HTTP POST communication for command and control.

KONNI has used HTTP POST for C2.

Winnti for Linux has used HTTP in outbound communications.

Shamoon has used HTTP for C2.

JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.

BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.

KGH_SPY can send data to C2 with HTTP POST requests.

down_new has the ability to use HTTP in C2 communications.

Ixeshe uses HTTP for command and control.

Micropsia uses HTTP and HTTPS for C2 network communications.

RedLine Stealer has utilized HTTP for C2 communications. RedLine Stealer has also conducted C2 communications to hardcoded C2 servers over HTTPS. RedLine Stealer has leveraged SOAP protocol for C2 communications.

VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.

OopsIE uses HTTP for C2 communications.

4H RAT uses HTTP for command and control.

DealersChoice uses HTTP for communication with the C2 server.

LitePower can use HTTP and HTTPS for C2 communications.

Crutch has conducted C2 communications with a Dropbox account using the HTTP API.

RTM has initiated connections to external domains using HTTPS.

QUIETCANARY can use HTTPS for C2 communications.

PHPsert can retrieve remote files using HTTP POST.

Hikit has used HTTP for C2.

StrelaStealer communicates externally via HTTP POST with encrypted content.

Grandoreiro has the ability to use HTTP in C2 communications.

LiteDuke can use HTTP GET requests in C2 communications.

Sakula uses HTTP for C2.

VaporRage can use HTTP to download shellcode from compromised websites.