Learning Malware Analysis

1.5 Malware Command and Control (C2)

The malware command and control (also called C&C or C2) refers to how attackers communicate and exhibit control of the infected system. Upon infecting the system, most malware communicates with the attacker-controlled server (C2 server) either to take commands, download additional components, or to exfiltrate information. Adversaries use different techniques and protocols for command and control. Traditionally, Internet Relay Chat (IRC) used to be the most common C2 channel for many years, but because IRC is not commonly used in organizations, it was possible to detect such traffic easily. Today, the most common protocol used by the malware for the C2 communication is HTTP/HTTPS. Using HTTP/HTTPS allows ...