Procedure examples

UBoatRAT encrypts instructions in its C2 network payloads using a simple XOR cipher.

HTTPTroy has obfuscated request communications utilizing XOR encryption.

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."

FatDuke can AES encrypt C2 communications.

Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.

LIGHTWIRE can RC4 encrypt C2 commands.

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.

PlugX can use RC4 encryption in C2 communications.

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.

SeaDuke C2 traffic has been encrypted with RC4 and AES.

Explosive has encrypted communications with the RC4 method.

Epic encrypts commands from the C2 server using a hardcoded key.

LightNeuron uses AES to encrypt C2 traffic.

PureCrypter can use AES to encrypt system information sent to the C2.

Mongall has the ability to RC4 encrypt C2 communications.

LockBit 3.0 can encrypt C2 communications with AES.

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.

NGLite will use an AES encrypted channel for command and control purposes, in one case using the key WHATswrongwithUu.

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.

Elise encrypts exfiltrated data with RC4.

Gazer uses custom encryption for C2 that uses 3DES.

TSCookie has encrypted network communications with RC4.

Latrodectus can send RC4 encrypted data over C2 channels.

LODEINFO can encrypt C2 communication with a hardcoded (NV4HDOeOVyL) Vigenere cipher key.

CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.

MuddyViper has the ability to encrypt C2 communication using AES-CBC using the CNG API, the key `0608101047106453101617106423101013101012101083109710108585106969`, and the initialization vector `0`.

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails

VIRTUALPIE can use a custom RC4 encrypted protocol for C2 communications.

SMOKEDHAM has encrypted its C2 traffic with RC4.

TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.

BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.

Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.

Metamorfo has encrypted C2 commands with AES-256.

Bandook has used AES encryption for C2 communication.

PipeMon communications are RC4 encrypted.

KONNI has used AES to encrypt C2 traffic.

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.

down_new has the ability to AES encrypt C2 communications.

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.

RTM encrypts C2 traffic with a custom RC4 variant.

QUIETCANARY can RC4 encrypt C2 communications.

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.