# Virus com? (1)
I want to know what format do you guys use to communicate with cnc is it json or custom format and why?

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode Virus com?

MagicByte
Elite
Posts:
57
Threads:
19
Joined:
Feb 2023
Reputation:
35
Credits: 75.7€ [Donate]
View All
#1
05-21-2023, 02:16 PM
I want to know what format do you guys use to communicate with cnc is it json or custom format and why?
PM Rate
Report
nullcat
Junior Member
Posts:
15
Threads:
2
Joined:
May 2023
Reputation:
0
Credits: 6.36€ [Donate]
#2
05-22-2023, 01:05 AM
In my experience JSON is a good format for CNC. It can be exchanged between different programming languages and is easy to work with
PM Rate
Reply Quote // Report
MagicByte
Elite
Posts:
57
Threads:
19
Joined:
Feb 2023
Reputation:
35
Credits: 75.7€ [Donate]
View All
#3
05-22-2023, 08:34 AM

> nullcat Wrote: In my experience JSON is a good format for CNC. It can be exchanged between different programming languages and is easy to work with

true but cant standardize it to allow for file uploads and downloads without base64
PM Rate
Reply Quote // Report
nullcat
Junior Member
Posts:
15
Threads:
2
Joined:
May 2023
Reputation:
0
Credits: 6.36€ [Donate]
#4
05-23-2023, 12:00 AM
That is true. You should look into custom protocols for communication (JSON packet header and bytes for the packet body)
PM Rate
Reply Quote // Report
dkota
Administrator
Posts:
194
Threads:
27
Joined:
Apr 2023
Reputation:
208
Credits: 5.93€ [Donate]
View All
#5
05-23-2023, 12:04 AM

> nullcat Wrote: That is true. You should look into custom protocols for communication (JSON packet header and bytes for the packet body)

I think protobuf or cbor are great for this
PM Rate
Reply Quote // Report
HeXsploit
Black Flag
Posts:
24
Threads:
7
Joined:
Feb 2023
Reputation:
41
Credits: 4.92€ [Donate]
#6
05-24-2023, 05:42 AM
If you have the time and knowledge to do so, writing your own format using cstructs provides alot more value to your malware. It makes reversing alot harder, it reduces the number of bytes sent, it adds less dependence on external stuff (like JSON libraries), it lets you set limits on data sizes (which means you can make your communication look bigger or smaller than it might normally be), and a myriad of other benefits.
For most generic crimeware though, most people will just opt for JSON + TLS and forget about it.
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| Do I need to consider virus protection when developing malware for targeted use | SciMartini | 2 | 179 | 04-21-2023, 04:06 PM Last Post: SciMartini

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }