Network-related syscalls are built around sockets. So far, there are no syscalls working with high-level protocols such as HTTP. Here are the ones that are commonly used by malware:
- socket: Create a socket
- connect: Connect to the remote server, for example, a C&C or another malicious peer
- bind: Bind an address to the socket, for example, a port to listen on
- listen: Listen for connections on a particular socket
- accept: Accept a remote connection
- send/sendto/write/...: Send data, for example, to steal some information or request new commands
- sendfile: Move data between two descriptors. It is optimized in terms of performance compared to using the combination of read and write
- recv/recvfrom/read/...: Receive data, for example, new modules to deploy or new commands
