Excerpt
This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.
Background
We have been tracking a previously unknown malware C2 protocol for several months. It first came to our attention back in April through packet captures from two sandbox executions created by Brad Duncan. The captures showed ClickFix attacks in which a fake CAPTCHA was used to deliver a previou…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Netresec on netresec.com.
More from Netresec2
- Ping32 RMM and ValleyRATNetresec · Published 25 Jun
- PureLogs, PureRAT and misleading zgRATNetresec · Published 27 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
