C2 Beacon: Extract the Callback Address

MediumDigital Forensics & Incident Response15-20 min

The brief

Malware was found on a host. Its dropper left a config behind that tells the implant where to phone home. Under /root/artifacts there's a hidden staging directory; somewhere in it is the command-and-control (C2) endpoint.

Find the C2 server's IP address and record it to /root/case/c2_ip.txt: a plain-text file holding just the IP on one line (the c2_host line copied as-is, or IP:port, is accepted too). The config buries it among decoy values (a version string, a mutex, an update mirror) — the real C2 line is labelled, but read carefully: only one address is the callback host.

grep -rIn -iE 'c2|callback|beacon' /root/artifacts

What you'll do

Locate the malware config under /root/artifacts
Record the C2 callback IP to /root/case/c2_ip.txt

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.