C2C communication

C2C (Command and Control) communications enable malware operators to remotely control infected systems and issue commands

[{"selector":"#anim-13d2f2dd-d090-4fb5-89a7-a91612616d0e [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-fbb09e5a-eaf2-4c51-aa21-e99149ca678c","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-dfe3f62b-890a-49ee-b3da-742066b0e876","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]

In remote overlay attacks like Mispadu/Ursa, C2C is used to manage the victim’s keyboard, mouse, and monitor their live screen

[{"selector":"#anim-b23013ae-90d0-409b-ad32-4f5de5ac1e6f [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-f12a9f87-287f-474d-9eaf-81f2859306f8","keyframes":{"transform":["translate3d(115.2381%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-06e748ba-41ee-46ae-99b9-a14d581fd0b8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f6b7201a-0c2d-405c-b6b2-46e7ff6d4b2b","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

C2C communication is typically initialized only when the victim visits a targeted website, reducing the risk of early detection by antivirus software

[{"selector":"#anim-e800d4bb-0ded-49d8-82b1-a5d5978d6500 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-00aa3f30-f5fa-40fa-b4cf-91c828b4e68e","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-01dad9ba-d2b8-4d9c-9a7e-f8537e7ce48d","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]

The malware establishes a socket connection to the C2C server using WIN32 Socket APIs, sending an encoded beacon message upon connection

[{"selector":"#anim-425d952a-e1e5-426c-83a3-8115be4b03b5 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-91fca755-f052-4cd6-ad68-b9fc8d49d106","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-91726332-d68a-41ae-9e37-e20369065ca0","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]

All messages between the malware and C2C server are encoded to obfuscate commands and evade network monitoring

[{"selector":"#anim-a399c68b-53cf-4d39-a809-c22167a6d28c [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-ae29dd9f-0040-4af8-98b6-775dfb8f2563","keyframes":{"transform":["translate3d(-115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e474290d-349f-4c79-b03c-344bfdea326d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-20f70ac7-30e8-4f7f-84aa-e11cae127faf","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

The decoding process involves mathematical operations on ASCII values, making it difficult to reverse-engineer without the algorithm

[{"selector":"#anim-c1411269-c94b-4b39-88d3-598a8552edea [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-5739629c-579a-4db1-9309-fee175865f55","keyframes":{"transform":["translate3d(115.55555%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d09888f9-9c7c-43d4-8e1d-44f7287ac3ac","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-da0b8fae-fe3d-46ab-8e79-3299c37e6565","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Once connected, the malware waits for and decodes commands from the C2C server, which dictate its malicious actions

[{"selector":"#anim-2757c65b-c44e-4215-9ac7-bd0a42f026ee [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-22995050-4a26-4acb-869c-bcd1673c9494","keyframes":{"transform":["rotate(-540deg) scale(0.1)","none"],"opacity":[0,1]},"delay":0,"duration":1000,"fill":"both","iterations":1}]

For more details visit Govindhtech.com

[{"selector":"#anim-c5269646-2a81-46dc-a0e2-78b9626308d0 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]