Command & Control (often shortened to C&C or C2) is an umbrella term used to refer to servers involved in the control and/or distribution of malware. This includes, but is not limited to, any servers that host malware payloads, issue commands to infected systems, or receive exfiltrated data.

C2s pose a unique challenge for malware analysts, because while the malware code may be available to reverse engineer, the C2 code typically is not. As such, it is not always clear how the C2 infrastructure works, or what it does.

Some threat actors will leverage the fact that C2 code is not public to implement server-side anti-analysis. One example of this could be uploading a list of running processes, then not providing the 2nd stage payload if any malware analysis related tools are detected.

These examples all communicated with a C2 server hosted by MalwareTech Labs, so you don’t have to worry about opsec. With that said, it’s still recommended to always perform any analysis inside a virtual machine for safety.

Inside the example malware you’ll find the code responsible for retrieving the flag from the C2 server. Your job is to perform static analysis to figure out how the C2 protocol works, then manually retrieve the flag from the server.

Recommended Environment

Host Machine: Anything with an x86_64 CPU (32-bit CPUs won’t work and ARM CPUs will require an emulator).
Virtual Machine: VMware or VirtualBox
Operating System: Windows 10 64-bit
Disassembler: Binary Ninja or Ghidra

Note: for Windows Labs the walkthrough videos will be done using Binary Ninja, with a 64-bit Windows 10 Virtual Machine running on VMWare Workstation Pro. You are free to choose your own software & hardware, just be aware that there will only be official support for the recommendations listed above, any custom setups are your own responsibility.