Learning Malware Analysis

1.5.2 Custom Command and Control

Adversaries may use a custom protocol or communicate over the non-standard port to hide their command and control traffic. The following is an example of such a malware sample (HEARTBEAT RAT) whose details are documented in the whitepaper (http://www.trendmicro.it/media/wp/the-heartbeat-apt-campaign-whitepaper-en.pdf). This malware makes an encrypted communication on port 80 using a custom protocol (not HTTP) and retrieves the command from the C2 server. It makes use of the Socket(), Connect(), Send(), and Recv() API calls to communicate and receive commands from the C2:

1. First, the malware calls the WSAStartup() API to initialize the Windows socket system. It then calls the Socket() API to create a socket, ...