> For the complete documentation index, see [llms.txt](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/guide/basic-dynamic-analysis/network-indicators.md).

# Network Indicators

## What are network indicators?

The network indicators are every call out or connection that is performed by a malware, it includes connections to a domain, downloading files, search for a C2 server and anything that includes network activity.

For the network Indicators, we will be running the malware while having our `REMnux` server running and listening on the interface using `Wireshark` to capture all the communications the malware does and what file it downloads.

## What indicators we are looking for?

<table data-full-width="true"><thead><tr><th>Category</th><th>Examples / Description</th></tr></thead><tbody><tr><td><strong>Suspicious Downloads</strong></td><td>Retrieval of executable files, scripts, or payloads from unknown or untrusted servers; download of secondary-stage malware; use of hidden paths or unusual file types (<code>.dat</code>, <code>.bin</code>, <code>.tmp</code>).</td></tr><tr><td><strong>Suspicious Domains</strong></td><td>Connections to domains with low reputation, recently registered domains, algorithmically generated domains (DGA), or domains known to host C2 infrastructure.</td></tr><tr><td><strong>C2 (Command and Control) Communications</strong></td><td>Periodic beaconing, encrypted traffic to unknown IPs, non-standard ports, use of custom protocols, long-lived connections, or irregular traffic intervals.</td></tr><tr><td><strong>Anomalous DNS Activity</strong></td><td>Excessive DNS queries, TXT-record abuse, queries to DGAs, DNS tunneling patterns, or repeated NXDOMAIN responses.</td></tr><tr><td><strong>Outbound Traffic Spikes</strong></td><td>Sudden high-volume data exfiltration, unusual upload behavior, data transfers during non-business hours, or communication to foreign regions.</td></tr><tr><td><strong>Suspicious Protocol Usage</strong></td><td>Use of protocols uncommon for the host (IRC, FTP, SMB over WAN), fallback to legacy or insecure protocols, or protocol misuse/abuse (HTTP POST used for binary exfiltration).</td></tr><tr><td><strong>Proxy or Network Configuration Changes</strong></td><td>Malware altering proxy settings, forcing traffic through attacker-controlled gateways, modifying DNS servers, or injecting PAC files.</td></tr><tr><td><strong>Encrypted or Obfuscated Traffic</strong></td><td>Custom encryption layers, traffic padding, base64/hex-encoded payloads over HTTP/S, or TLS sessions with invalid/self-signed certificates.</td></tr><tr><td><strong>Peer-to-Peer (P2P) Communications</strong></td><td>Connections to multiple random peers, decentralized C2 networks, or botnet-style communication patterns.</td></tr><tr><td><strong>Beaconing Patterns</strong></td><td>Regular check-ins at fixed intervals, jittered beaconing, or heartbeat-like small data packets to C2 domains or IPs.</td></tr></tbody></table>

## How to obtain network indicators?

As these indicators varies so much, check the [Case Study](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/case-study/) to have full site about what is the process, generally here are 3 steps to be done

1. Make sure you have all the tools running properly
2. Run the malware
3. Observe the result on our `REMnux` server and Wireshark on it and track the sequence of connections it does