CNCMachineRMS C2 Protocol

This post describes the binary command-and-control (C2) protocol used by CNCMachineRMS, a recently identified remote access trojan (RAT). We cover how the protocol was discovered, how its infrastructure was identified, and how network defenders can detect it.

Background

We have been tracking a previously unknown malware C2 protocol for several months. It first came to our attention back in April through packet captures from two sandbox executions created by Brad Duncan.

The captures showed ClickFix attacks in which a fake CAPTCHA was used to deliver a previously unknown remote access trojan. The RAT communicated with 89.110.110.119 over TCP port 443. Although the traffic used port 443, it was not protected by TLS and did not resemble any previously known C2 protocol.

We later added a detection model for the protocol to FlowCarp. At that point, the protocol was labeled "Unknown_16". Using FlowCarp, we identified additional C2 servers using the same protocol. All of them exposed the C2 service on TCP port 443:

• 85.158.110.78
• 89.110.110.119
• 89.124.79.98
• 144.124.242.171

Brad Duncan’s malware captures were instrumental in identifying this infrastructure. We then used the IP addresses and hashes from Brad’s executions to find additional samples and executions of the same malware family on ANY.RUN, Joe Sandbox, and Triage.

CNCMachineRMS

I only recently read Rodel Mendrez’s excellent writeup CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain. The report confirmed that the malware Rodel had reverse engineered was the same malware we had observed communicating in Brad Duncan’s PCAP files. In particular, the report mentions the IP address 85.158.110.78 and the domain notepadreleased[.]com.

One notable feature is the malware’s use of DNS over HTTPS (DoH). Rather than sending the C2 domain lookup to the system’s usual DNS resolver, CNCMachineRMS sends the query over HTTPS to an external DoH provider. Rodel also mentioned this in his report:

The payload resolves its C2 domain over DNS over HTTPS, using dns.google, cloudflare-dns.com and dns.quad9.net. Local DNS logs will not show the lookup.

Image: Decrypted DoH query for notepadreleased[.]com from ANY.RUN

Even without extracting crypto keys from memory or using a TLS inspection tool like PolarProxy, you can still see a TLS encrypted connection to a DoH provider such as dns.google. This usually happens just seconds before CNCMachineRMS connects to its C2 server.

Network Detection

FlowCarp uses a statistical model of the CNCMachineRMS binary protocol to detect similar traffic. This made it possible to add support for the CNCMachineRMS C2 protocol by providing FlowCarp with some example C2 sessions.

To our knowledge, no IDS signatures currently exist for this protocol. However, the traffic appears relatively straightforward to identify. Several fields contain consecutive 0x00 or 0xff bytes at fixed offsets, creating a distinctive pattern across the protocol’s messages.

Image: CapLoader flow transcript of CNCMachineRMS traffic

Note: Yellow 0xff fields contain 0x00 in some connections.

You can test a PCAP file for CNCMachineRMS traffic by submitting it to the free FlowCarp demo server:

If the file contains CNCMachineRMS traffic, the response includes a JSON alert similar to the following:

IOC List

Posted by Erik Hjelmvik on Friday, 21 August 2026 14:45:00 (UTC/GMT)

Tags: #FlowCarp​ #malware-traffic-analysis.net​ #ANY.RUN​ #DoH​