Procedure examples

Ninja can configure its agent to work only in specific time frames.

TinyTurla contacts its C2 based on a scheduled timing set in its configuration.

Machete sends stolen data to the C2 server every 10 minutes.

Kazuar can sleep for a specific time and be set to communicate at specific intervals.

ShimRat can sleep when instructed to do so by the C2.

Chrommme can set itself to sleep before requesting a new command from C2.

Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.

LightNeuron can be configured to exfiltrate data during nighttime or working hours.

Shark can pause C2 communications for a specified time.

Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).

Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.

POWERSTATS can sleep for a given number of seconds.

Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.

ShadowPad has sent data back to C2 every 8 hours.

jRAT can be configured to reconnect at certain intervals.

ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.