Malware using legitimate API services for C2 channel