[mtlynch]

Yeah, exactly. If there's a C2 server, there's some protocol for communication between the C2 server and each victim node.

You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.

Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.