GuidedHacking
patreon
How to Find Malware C2 Panels
🕑 Added 2023-05-14 15:22:02 +0000 UTCCommand and control web panels are an incredibly important part of malware and malware analysis. These web panels are where the threat actors will take control of their victims and task their malware. Commonly these web panels are written in PHP but over the years have been changing into different languages. They are usually hosted on port 443 or 80 on a webserver where the gate for the malware will also lay along with with the command and control panel. Because these web panels are a great way to track malware and can be used as indicators of compromise it would be good for us to make use of them.
We begin getting comfortable with web panels by using public threat trackers which provide a list of malware control panels that we can take a look at and use as a starting point for our search. I look through ViriBacks tracker (ViriBack C2 Tracker) to find some web panels. Looking at Amadey malware we can see that the web panel is a hostname followed by a subdirectory of random characters and then Login.php as the web panel login where the threat actor can then access the malware. Looking at a detonation of Amadey and checking the traffic it communicates to a index.php file within the same subdirectory that contains the login page. If we visit the index page it then redirects to the login page.
You don't always have a binary to check the traffic of so we will need to be able to find the C2s without relying on the binary detonations. What we want to do is create a dork for a given C2 panel so that we can find all panels found by a host search engine such as Censys (Censys Search) . I first take a Lumma malware command and control web panel and put the hostname into Censys.
I can then look through Censys to find some kind of value on the hostname that may be common over all other instances. Checking items such as the HTTP service name or HTTP response length these are too generic or changing per host to be able to be found. Instead we need something unique to each installation of Lumma so I will use a combination of the HTML title tag. A bit of russian text in the HTML body and the port of 80. I can combine all these searches and will get 26 results.
