MalwareC2Server

MalwareC2Server

Overview

MalwareC2Server is a safe command-and-control simulation for local lab and detection-engineering use. It models the structure of a C2 workflow without implementing arbitrary command execution, persistence, or offensive behavior.

The project models:

• agent registration
• task queueing
• agent polling
• task execution using a small set of benign built-in actions
• structured reporting back to the server

Safety Model

This repository version does not execute arbitrary shell commands and does not function as real malware. The agent only supports a fixed set of harmless tasks:

• collect_hostname
• collect_os
• collect_time
• heartbeat

Tech Stack

• Python 3
• Flask for the local coordination API
• Requests for agent HTTP communication
• Standard library: argparse, datetime, platform, uuid

Project Structure

MalwareC2Server/
|-- C2Server.py
|-- MalwareClient.py
|-- README.md
`-- requirements.txt

Requirements

python -m pip install -r requirements.txt

Usage

1. Start the simulation server

cd D:\Cybersec\MalwareC2Server
python C2Server.py

2. Queue a task for an agent

Example using PowerShell:

Invoke-RestMethod -Method Post -Uri http://127.0.0.1:8080/queue-task -ContentType "application/json" -Body '{"agent_id":"agent-lab-01","task_name":"collect_hostname"}'

3. Run the simulated agent

python MalwareClient.py --server http://127.0.0.1:8080 --agent-id agent-lab-01 --poll-count 3

4. Review agents and reports

Invoke-RestMethod http://127.0.0.1:8080/agents
Invoke-RestMethod http://127.0.0.1:8080/reports

API Summary

• POST /register
• POST /queue-task
• GET /task?agent_id=<id>
• POST /report
• GET /agents
• GET /reports
• GET /health

Capabilities

• command-and-control workflow simulation
• REST API design for agent coordination
• agent registration and polling patterns
• structured telemetry and reporting
• malware-analysis-lab workflow without offensive execution features