Procedure examples

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.

Havoc can send an AES encrypted check-in request to the C2 server.

xCaon has encrypted data sent to the C2 server using a XOR key.

PLAINTEE encodes C2 beacons using XOR.

Nebulae can use RC4 and XOR to encrypt C2 communications.

Lurid performs XOR encryption.

TONESHELL has used RC4 encryption in C2 communications. TONESHELL variants used a randomly generated variable length (0x20 - 0x200 bytes) rolling XOR key to encrypt and decrypt network packets.

RainyDay can use RC4 to encrypt C2 communications.

NETWIRE can use AES encryption for C2 data transferred.

BOOKWORM has used encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

HyperStack has used RSA encryption for C2 communications.

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.

GreyEnergy encrypts communications using AES256.

Emotet is known to use RSA keys for encrypting C2 traffic.

SNUGRIDE encrypts C2 traffic using AES with a static key.

THINCRUST can process RSA encryted C2 commands.

Machete has used AES to exfiltrate documents.

Prikormka encrypts some C2 traffic with the Blowfish cipher.

PUBLOAD has used RC4 encryption in C2 communications.

SystemBC has encrypted its C2 traffic with RC4.

PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.

Woody RAT can use AES-CBC to encrypt data sent to its C2 server.

Mafalda can encrypt its C2 traffic with RC4.

SombRAT has encrypted its C2 communications with AES.

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.

Rifdoor has encrypted command and control (C2) communications with a stream cipher.

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.

Volgmer uses a simple XOR cipher to encrypt traffic and files.

ZeroT has used RC4 to encrypt C2 traffic.

RDAT has used AES ciphertext to encode C2 communications.

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.

Bonadan can XOR-encrypt C2 communications.

RustyWater has encrypted encoded data with XOR before sending it to the C2 server.

UBoatRAT encrypts instructions in its C2 network payloads using a simple XOR cipher.

HTTPTroy has obfuscated request communications utilizing XOR encryption.

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."

FatDuke can AES encrypt C2 communications.

Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.

LIGHTWIRE can RC4 encrypt C2 commands.

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.

PlugX can use RC4 encryption in C2 communications.

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.

SeaDuke C2 traffic has been encrypted with RC4 and AES.

Explosive has encrypted communications with the RC4 method.