CNCMachineRMS C2 Protocol
Brief
-- This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.
Background
We have been tracking a previously unknown malware C2 protocol for several months. It first came to our attention back in April through packet captures from two sandbox executions created by Brad Duncan .
The captures showed ClickFix attacks in which a fake CAPTCHA was used to deliver a previously unknown remote access trojan. The RAT communicated with 89.
- 110. 119 over TCP port 443. Although the traffic used port 443, it was not protected by TLS and did not resemble any previously known C2 protocol.
We later added a detection model for the protocol to FlowCarp .