僵尸网络与DGA/C2分析

---
name: botnet-analysis
description: >
  Analyze botnet command-and-control infrastructure, communication protocols,
  and Domain Generation Algorithms. Use when investigating bot malware, C2
  servers, DGA domains, botnet topology, or coordinated malicious network
  activity from multiple infected hosts.
---

# Botnet Analysis

Systematic approach to analyzing botnet C2 infrastructure, communication protocols, and network topology.

## When to Use

- Malware communicates with remote C2 servers
- Suspected DGA (Domain Generation Algorithm) activity
- Multiple hosts showing coordinated malicious behavior
- Need to reverse engineer C2 protocol
- Planning sinkhole or takedown operations

## Prerequisites

- **Python 3.10+** with standard library modules
- **Wireshark/tshark**: Network protocol analysis and PCAP inspection
- **DGArchive**: Reference database for known DGA families
- **scripts/ioc_extractor.py**: IOC extraction from binary samples
- **scripts/c2_protocol_analyzer.py**: C2 protocol traffic analysis
- **scripts/dga_detector.py**: DGA domain detection from DNS logs
- **PCAP captures** or network logs from suspected botnet traffic
- **Snort/Suricata**: Network detection rule deployment
- **YARA**: Pattern-based detection rule creation

## Step-by-Step Instructions

### Step 1: Identify C2 Communication

Extract network indicators from malware sample:

```bash
# Extract URLs, domains, IPs from binary
python3 scripts/ioc_extractor.py <sample> --types domain,ip,url

# Analyze PCAP for C2 traffic patterns
python3 scripts/c2_protocol_analyzer.py --pcap capture.pcap
```

Check for:
- Hardcoded C2 addresses (IPs, domains)
- DGA implementation in code
- Peer-to-peer communication mechanisms
- Fallback/backup C2 channels

### Step 2: Classify Botnet Architecture

**Centralized (Client-Server):**
- Single or few C2 servers
- Bot connects directly to C2
- Easier to take down, single point of failure
- Examples: Zeus, Emotet early variants

**Decentralized (Peer-to-Peer):**
- Bots communicate with each other
- No single C2 server
- Resilient to takedown
- Examples: Gameover Zeus, Hajime

**Hybrid:**
- Combines centralized C2 with P2P fallback
- Resilient and flexible
- Examples: TrickBot, Emotet later variants

### Step 3: DGA Analysis

If domain generation algorithm is suspected:

```bash
# Detect DGA domains from DNS logs or PCAP
python3 scripts/dga_detector.py --input dns_queries.txt

# Analyze DGA algorithm from binary
# Look for: date-based seeds, character generation loops,
# TLD selection arrays, domain length patterns
```

DGA identification approaches:
1. **Statistical**: High entropy, unusual character distributions
2. **Linguistic**: Non-dictionary bigrams/trigrams, low pronounceability
3. **Temporal**: Large volume of NXDomain responses
4. **Algorithmic**: Reverse engineer from malware code

### Step 4: Protocol Reverse Engineering

Capture and analyze C2 communication:

```bash
python3 scripts/c2_protocol_analyzer.py --pcap capture.pcap --output protocol_analysis.json
```

Common C2 protocol types:
- **HTTP/HTTPS**: Custom headers, URI patterns, POST data encoding (Base64, XOR, custom)
- **DNS**: TXT records, long subdomain encoding, CNAME tunneling
- **IRC**: Channel-based commands, topic-encoded instructions
- **Custom binary**: Proprietary protocols over TCP/UDP
- **Cloud services**: Using legitimate platforms (Telegram, Discord, Pastebin)

Analyze:
1. Registration/check-in message format
2. Command structure and encoding
3. Response format
4. Encryption/obfuscation methods
5. Keep-alive/heartbeat mechanism

### Step 5: Command Structure Analysis

Document the bot command set:
- System information gathering commands
- File download/upload commands
- Module/plugin loading
- DDoS attack commands
- Credential harvesting triggers
- Lateral movement instructions
- Self-update mechanism
- Kill switch/uninstall command

### Step 6: Infrastructure Mapping

```bash
# Map C2 infrastructure relationships
# Use passive DNS, WHOIS, certificate transparency
# See apt-analysis skill for infrastructure_mapper.py
```

Document:
- Active C2 servers (IPs, domains)
- Registration patterns (registrar, WHOIS privacy)
- Hosting patterns (bulletproof hosting, fast flux)
- SSL certificate fingerprints
- Related infrastructure (staging servers, drop zones)

### Step 7: Sinkhole Planning

For takedown/sinkhole operations:
1. Register predicted DGA domains before threat actor
2. Coordinate with registrars and hosting providers
3. Set up sinkhole server to count infected hosts
4. Monitor for C2 migration/protocol changes
5. Document legal and coordination requirements

### Step 8: Report and Detect

- Generate IOCs: C2 domains/IPs, DGA patterns, protocol signatures
- Create network detection rules (Snort/Suricata)
- YARA rules for bot binary
- Map to MITRE ATT&CK:
  - T1071: Application Layer Protocol
  - T1568: Dynamic Resolution (DGA)
  - T1573: Encrypted Channel
  - T1095: Non-Application Layer Protocol

## Tools

| Tool | Purpose |
|------|---------|
| Wireshark/tshark | Protocol analysis |
| DGArchive | Known DGA reference |
| scripts/dga_detector.py | DGA domain detection |
| scripts/c2_protocol_analyzer.py | C2 protocol analysis |

## Related Skills

- `network-traffic-analysis` — PCAP analysis fundamentals
- `reverse-engineering` — Protocol RE from binary
- `ioc-extraction` — Extract network indicators
- `threat-intelligence` — Correlate C2 infrastructure