Анализ C2-коммуникаций вредоносного ПО

★ 8.4 · security

analyzing-command-and-control-communication is a Claude Code skill that reverse-engineers malware C2 traffic over HTTP, HTTPS, DNS, and custom protocols to extract beacon patterns, command structures, data encoding schemes, and full infrastructure maps including primary servers, fallback domains, and dead drops. It fits into a malware analysis workflow after initial reverse engineering reveals network activity that requires protocol-level dissection, or when writing detection signatures for frameworks such as Cobalt Strike, Metasploit, or Sliver. The skill walks through four stages: identifying the C2 channel type, profiling beacon intervals and jitter with scapy and Python's statistics module, decoding request bodies with dpkt and Base64 helpers, and correlating infrastructure against VirusTotal, Shodan, and Censys. Prerequisites include a PCAP capture, Wireshark, Ghidra or dnSpy, Python 3.8+ with scapy and dpkt, and JA3/JA3S fingerprint databases for TLS-based C2 identification.