Procedure examples

Helminth encrypts data sent to its C2 server over HTTP with RC4.

Dridex has encrypted traffic with RC4.

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.

Comnie encrypts command and control communications with RC4.

H1N1 encrypts C2 traffic using an RC4 key.

Azorult can encrypt C2 traffic using XOR.

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.

A variant of ADVSTORESHELL encrypts some C2 with 3DES.

StrifeWater can encrypt C2 traffic using XOR with a hard coded key.

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.

WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.

FALLCHILL encrypts C2 data with RC4 encryption.

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.

FRP can use STCP (Secret TCP) with a preshared key to encrypt services exposed to public networks.

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.

TeamPCP Cloud Stealer has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.