> Technique · raw-tcp-c2-socket — Raw TCP socket C2 without application-layer framing_

~/packetpursuit $ cat /intel/techniques/raw-tcp-c2-socket.md

typetechniqueconfidencehighcreated2026-07-10updated2026-07-10c2c2-protocolmitre-attckpe

raw-tcp-c2-socket

Malware that communicates with its operator over raw TCP sockets without wrapping the payload in HTTP, HTTPS, DNS, or another application-layer protocol. The C2 traffic is typically a custom byte stream or plaintext token protocol.

Detection / Fingerprint

  • Imports wsock32.dll or WS2_32.dll with direct use of socket, connect, send, recv, listen, accept.
  • No InternetOpenA/HttpOpenRequest/WinHttp calls for C2 traffic (though downloaders may still use HTTP for secondary payloads).
  • Network traffic is unencrypted or uses a custom stream cipher; no TLS handshake observed.
  • Process creates a TCP socket shortly after launch and maintains a persistent connection or enters a listen/bind state.

Variants Observed

Family Framing Notes
darkcomet Plaintext tokens (#KCMDDC5#-, #BOT#) Delphi VCL builder-kit default
remcos Raw TCP + RC4-encrypted config Often uses WS2_32.dll
meterpreter TLV (Type-Length-Value) over reverse TCP Metasploit native framing

Defensive Countermeasures

  • Monitor for processes that are not browsers/email clients but open outbound TCP connections to non-standard ports.
  • Look for socket → connect sequences in binaries with GUI subsystem but no legitimate network purpose.
  • Network IDS: detect plaintext command tokens (#BOT#, PING, PONG, SHELL) in outbound TCP streams.

Pages Where Observed

  • /intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html