As long as the analyst has access to the code, it makes sense to prepare and prioritize a list of questions to answer. Generally, the following knowledge can be obtained from the backend:
- It is an actual backend code or a proxy redirecting messages to another location?
- What URI or port does malware utilize?
- What is the format of the accepted requests or messages and is there any encryption involved?
- Are there any commands that it can return to malware, either automatically or on demand?
- Is there a web interface or dashboard available for the attacker?
- What are the locations for the logs, the additional payloads delivered, and the stolen data?
- Are there any statistics about affected users available?
- Are there any logs that will reveal the malware writer's identity? The SSH or RDP/custom RAT logs might help answer this question.
More advanced steps include searching for communication patterns that might help identify future C&Cs. If the HTTPS protocol was used...
