GuidedHacking

How to Find Malware C2 Panels (Patreon)

Published:

2023-05-14 15:22:02

Imported:

2026-06

haven't archived this post yet. have a subscription? use the importer!

Content

Command and control web panels are an incredibly important part of malware and malware analysis. These web panels are where the threat actors will take control of their victims and task their malware. Commonly these web panels are written in PHP but over the years have been changing into different languages. They are usually hosted on port 443 or 80 on a webserver where the gate for the malware will also lay along with with the command and control panel. Because these web panels are a great way to track malware and can be used as indicators of compromise it would be good for us to make use of them.

We begin getting comfortable with web panels by using public threat trackers which provide a list of malware control panels that we can take a look at and use as a starting point for our search. I look through ViriBacks tracker (ViriBack C2 Tracker) to find some web panels. Looking at Amadey malware we can see that the web panel is a hostname followed by a subdirectory of random characters and then Login.php as the web panel login where the threat actor can then access the malware. Looking at a detonation of Amadey and checking the traffic it communicates to a index.php file within the same subdirectory that contains the login page. If we visit the index page it then redirects to the login page.

You don't always have a binary to check the traffic of so we will need to be able to find the C2s without relying on the binary detonations. What we want to do is create a dork for a given C2 panel so that we can find all panels found by a host search engine such as Censys (Censys Search) . I first take a Lumma malware command and control web panel and put the hostname into Censys.

I can then look through Censys to find some kind of value on the hostname that may be common over all other instances. Checking items such as the HTTP service name or HTTP response length these are too generic or changing per host to be able to be found. Instead we need something unique to each installation of Lumma so I will use a combination of the HTML title tag. A bit of russian text in the HTML body and the port of 80. I can combine all these searches and will get 26 results.

Files

Previews only

👨‍💻 How to Find Malware C2 Panels 🔎 Skid Hunting 👀

🔥 Learn How to Find C2 Panels and Laugh at Cyber Criminals 👨‍💻 Buy Our Courses: https://guidedhacking.com/register/ 💰 Donate on Patreon: https://patreon.com/guidedhacking ❤️ Follow us on Social Media: https://linktr.ee/guidedhacking 🔗 Article Link: https://guidedhacking.com/threads/how-to-find-malware-c2-panels-threat-hunting.20358/ 🔗 ViriBack C2 Tracker: https://tracker.viriback.com/ 🔗Censys: https://search.censys.io/ 🔗Shodan: https://malware-hunter.shodan.io/ 🔗 ThreatFox: https://threatfox.abuse.ch/ 🔗URLScan.io: https://urlscan.io/ 📜 Video Description: How to Find C2 Panels Understanding and Locating Malware Command and Control Web Panels In the world of malware, command and control web panels are the real puppet masters. They're the platforms where threat actors seize control of their victims and assign tasks to their malicious software. This guide will delve into where to find command and control servers and understand their inner workings, which are pivotal in malware analysis. Web panels, often referred to as C2 servers, are traditionally written in PHP and often hosted on a web server's port 443 or 80. This is also where the malware's gateway coexists with the command and control servers. These C2 servers play a crucial role in tracking malware and can function as indicators of compromise. Hence, it's highly beneficial for us to tap into them and learn how to find C2 panels effectively. To familiarize yourself with these C2 servers, a good starting point is using public threat trackers. These resources offer a list of malware control panels to scrutinize. For instance, the ViriBack C2 Tracker can be a handy tool to identify some web panels. Let's take the example of the Amadey malware. Its command and control server appears as a hostname followed by a subdirectory of random characters, finally leading to Login.php. This is where the threat actor can access the malware. An examination of Amadey's detonation reveals that it communicates with an index.php file within the same subdirectory containing the login page. Visiting the index page subsequently redirects you to the login page, showcasing one way of how to find malware C2 panels. Finding C2s Without Binary Detonations: The Art of Locating C2 Servers You won't always have a binary to check the traffic, so we need to find the C2s without depending on binary detonations. The goal here is to understand how to find C2 panels, specifically to create a 'dork' for a given C2 panel, which would allow us to locate all panels discovered by a host search engine, such as Censys. To illustrate, let's use the Lumma malware command and control web panel. Firstly, input the hostname into Censys. From here, you would want to find a value on the hostname that might be common across all other instances. This could be anything from the HTTP service name to the HTTP response length. However, these features are usually too generic or variable per host to be identifiable. Instead, we need something unique to each installation of Lumma. In this case, a combination of the HTML title tag, some Russian text in the HTML body, and the port of 80 turns out to be the unique identifier. By combining all these searches, we could end up with 26 results. This is yet another way of how to find malware C2 panels. In the realm of cybersecurity, one term that often emerges is the "Malware Command and Control Interface." This terminology refers to a key component of a cyber attacker's arsenal, the Malware C2 Panel. The C2 panel is a unique tool that malicious actors use to control and manage the activities of malware after it has infiltrated a system. To sum it up, the process of unearthing and understanding command and control servers can be an intriguing yet challenging endeavor. But with the right tools and a bit of persistence, you'll soon be able to navigate through the labyrinth of these digital puppet masters, mastering the art of how to find C2 panels. 📝 Timestamps: 0:00 - Introduction 0:09 - Exploring C2 Panel Trackers 1:06 - Safety Precautions 1:25 - Different Malware Protocols 2:02 - Different Malware Families 3:42 - GuidedHacking.com Is the Best 4:09 - Finding C2 Panels for Specific Malware 7:15 - Comparing Different C2 Installations 8:31 - Narrowing Down Search 9:22 - Verifying Results with URLscan.io 10:02 - Find HTTP Panels with URLscan.io ✏️ Tags: #malwareanalysis how to find malware c2 panels #reverseengineering scanning for command and control servers #malware