https://blog.efespain.com/en/tags/c2/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-22/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-22/A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none — and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.https://blog.efespain.com/en/chapter-2/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-2/In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.https://blog.efespain.com/en/chapter-4/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-4/The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal — without handing out weapons.