Procedure examples

OSX_OCEANLOTUS.D encrypts data sent back to the C2 using AES in CBC mode with a null initialization vector (IV) and a key sent from the server that is padded to 32 bytes.

Taidoor uses RC4 to encrypt the message body of HTTP content.

PoisonIvy uses the Camellia cipher to encrypt communications.

NanoCore uses DES to encrypt the C2 traffic.

PLEAD has used RC4 encryption to download modules.

Daserf uses RC4 encryption to obfuscate HTTP traffic.

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.

Solar can XOR encrypt C2 communications.

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.

More_eggs has used an RC4-based encryption method for its C2 communications.

SysUpdate has used DES to encrypt all C2 communications.

Mango can receive XOR-encrypted commands from C2.

WIREFIRE can AES encrypt process output sent from compromised devices to C2.

GrimAgent can use an AES key to encrypt C2 communications.

LookBack uses a modified version of RC4 for data transfer.

CallMe uses AES to encrypt C2 traffic.

CHOPSTICK encrypts C2 communications with RC4.

RIFLESPINE can use the AES algorithm to encrypt C2 data.

SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.

Winnti for Windows can XOR encrypt C2 traffic.

Troll Stealer encrypts data sent to command and control infrastructure using a combination of RC4 and RSA-4096 algorithms.

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.

ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.

ChChes can encrypt C2 traffic with AES or RC4.

The IceApple Result Retriever module can AES encrypt C2 responses.

metaMain can encrypt the data that it sends and receives from the C2 server using an RC4 encryption algorithm.

SideTwist can encrypt C2 communications with a randomly generated key.

LunarWeb can send AES encrypted C2 commands.

XCSSET uses RC4 encryption over TCP to communicate with its C2 server.

Dipsind encrypts C2 data with AES256 in ECB mode.

httpclient encrypts C2 content with XOR using a single byte, 0x12.

POWERTON has used AES for encrypting C2 traffic.

StarProxy has leveraged two 256-byte XOR keys to encrypt and decrypt network packets using a custom algorithm.

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

QakBot can RC4 encrypt strings in C2 communication.

Helminth encrypts data sent to its C2 server over HTTP with RC4.

Dridex has encrypted traffic with RC4.

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.

Comnie encrypts command and control communications with RC4.

H1N1 encrypts C2 traffic using an RC4 key.

Azorult can encrypt C2 traffic using XOR.

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.

A variant of ADVSTORESHELL encrypts some C2 with 3DES.

StrifeWater can encrypt C2 traffic using XOR with a hard coded key.

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.

WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.

FALLCHILL encrypts C2 data with RC4 encryption.

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.

FRP can use STCP (Secret TCP) with a preshared key to encrypt services exposed to public networks.