Procedure examples

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.

BLINDINGCAN has encrypted its C2 traffic with RC4.

Ninja can XOR and AES encrypt C2 messages.

Earlier Pikabot variants use a custom encryption procedure leveraging multiple mechanisms including AES with multiple rounds of Base64 encoding for its command and control communication. Later Pikabot variants eliminate the use of AES and instead use RC4 encryption for transmitted information.

Bumblebee can encrypt C2 requests and responses with RC4

Torisma has encrypted its C2 communications using XOR and VEST-32.

Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.

Downdelph uses RC4 to encrypt C2 responses.

RotaJakiro encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compression.

Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.

TAMECAT has used AES to encrypt C2 traffic.

CASTLETAP can receive a 9-byte XOR encrypted activation string in the payload of an ICMP echo request packet.

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.

Havoc can send an AES encrypted check-in request to the C2 server.

xCaon has encrypted data sent to the C2 server using a XOR key.

PLAINTEE encodes C2 beacons using XOR.

Nebulae can use RC4 and XOR to encrypt C2 communications.

Lurid performs XOR encryption.

TONESHELL has used RC4 encryption in C2 communications. TONESHELL variants used a randomly generated variable length (0x20 - 0x200 bytes) rolling XOR key to encrypt and decrypt network packets.

RainyDay can use RC4 to encrypt C2 communications.

NETWIRE can use AES encryption for C2 data transferred.

BOOKWORM has used encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

HyperStack has used RSA encryption for C2 communications.

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.

GreyEnergy encrypts communications using AES256.

Emotet is known to use RSA keys for encrypting C2 traffic.

SNUGRIDE encrypts C2 traffic using AES with a static key.

THINCRUST can process RSA encryted C2 commands.

Machete has used AES to exfiltrate documents.

Prikormka encrypts some C2 traffic with the Blowfish cipher.

PUBLOAD has used RC4 encryption in C2 communications.

SystemBC has encrypted its C2 traffic with RC4.

PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.

Woody RAT can use AES-CBC to encrypt data sent to its C2 server.

Mafalda can encrypt its C2 traffic with RC4.

SombRAT has encrypted its C2 communications with AES.

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.

Rifdoor has encrypted command and control (C2) communications with a stream cipher.

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.

Volgmer uses a simple XOR cipher to encrypt traffic and files.

ZeroT has used RC4 to encrypt C2 traffic.

RDAT has used AES ciphertext to encode C2 communications.

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.

Bonadan can XOR-encrypt C2 communications.

RustyWater has encrypted encoded data with XOR before sending it to the C2 server.