Technical Analysis

In the following sections, ThreatLabz examines the technical details of the identified C2Looper variants, including their features, network communication protocols and commands.

String encryption and Windows API resolution

All identified C2Looper variants use string encryption and dynamically resolve Windows APIs.

• C2Looper uses the Windows API functions LoadLibrary and GetProcAddress to load and resolve any necessary functions at runtime. 
• C2Looper decrypts strings at runtime using a bitwise XOR operation with an 8-byte key. Despite not having a single decryption function for every encrypted string, C2Looper uses the same XOR key throughout the code.

Network communication

C2Looper uses plaintext HTTP to communicate with its C2 server through a simple network protocol. First, C2Looper collects host information and sends it to the C2 server as a JSON object in an HTTP POST request. The JSON object contains the following information:

• Username.
• DNS hostname of the compromised host.
• The process identifier (PID) of C2Looper that is currently running on the compromised host.
• Bot ID (id key), which is a combination of the username and hostname.

This information is formatted as follows:

{
  "id": "DNSHOSTNAME_Username",
  "user": "username",
  "host": "DNSHOSTNAME",
  "pid": C2LOOPER_PID_NUMBER
}

C2Looper sends this information to the endpoint /api/beacon every second to request a command. Each command that is received from the C2 server is formatted as a JSON object containing the keys described in the table below. 

Table 1: C2Looper command message format.

The table below describes the C2 endpoints used by C2Looper.

Table 2: C2Looper C2 endpoints.

The table below describes the commands supported by C2Looper.

Table 3: Commands supported by C2Looper in older variants.

ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.

C2Looper version 2

During our research, ThreatLabz identified a new version of C2Looper that supports additional commands, and most interestingly, uses GitHub for C2 communication. We also observed that the older C2Looper variant described previously was used to download the latest version of C2Looper through the upload command. This latest version appears to be internally tagged as version 2 as we will discuss later. 

C2Looper v2 uses GitHub for all C2 operations, including storing exfiltrated data and reporting command output. In addition to the use of GitHub, C2Looper v2 introduces new commands and modifies the functionality of existing commands. The table below describes these additions and changes.

Table 4: C2Looper v2 commands. 

Furthermore, we identified the following noteworthy changes:

• Unlike the previous variant, the beacon request includes only the host’s username and timestamp (based on the host’s local time).
• The binary includes debug messages including !!! v2 !!! pongv2 from. This is used as a response when the network command ping is used. This is an indicator that the malware developer refers to this variant as version 2 of C2Looper.
• The JSON key ok has been removed from beacon requests and responses.
• The parsing bug related to the JSON key seq has been fixed in this version and C2Looper uses the correct task ID with the appropriate command output. 

Since this variant uses GitHub for C2 communication, the endpoints have been removed. Instead, C2Looper creates a directory for each bot in the GitHub repository and uses the JSON files in the table below:

Table 5: JSON files used by C2Looper v2 with GitHub-based C2 communication.