Researchers created a fake Diceloader C2 for further investigation, revealing the communication type between the malware and the C2 server. The Diceloader received data from its C2 after declaring itself to the server with a unique sequence of bytes.

Source: GBHackers