Encrypted Channel: Symmetric Cryptography

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails^[1]

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.^[1]

A variant of ADVSTORESHELL encrypts some C2 with 3DES.^[2]

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.^[3]

APT33 has used AES for encryption of command and control traffic.^[4]

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.^[5]

Azorult can encrypt C2 traffic using XOR.^[6][7]

BADCALL encrypts C2 traffic using an XOR/ADD cipher.^[8]

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.^[9][10]

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.^[11]

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.^[12]

Bonadan can XOR-encrypt C2 communications.^[13]

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.^[14]

CallMe uses AES to encrypt C2 traffic.^[15]

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.^[16][17]

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.^[18]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[19]

ChChes can encrypt C2 traffic with AES or RC4.^[20][21]

CHOPSTICK encrypts C2 communications with RC4.^[22]

Comnie encrypts command and control communications with RC4.^[23]

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.^[24]

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.^[25]

Daserf uses RC4 encryption to obfuscate HTTP traffic.^[14]

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.^[26]

Dipsind encrypts C2 data with AES256 in ECB mode.^[27]

down_new has the ability to AES encrypt C2 communications.^[28]

Downdelph uses RC4 to encrypt C2 responses.^[29]

Dridex has encrypted traffic with RC4.^[30]

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.^[31]

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.^[32]

Elise encrypts exfiltrated data with RC4.^[33]

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.^[34]

Epic encrypts commands from the C2 server using a hardcoded key.^[35]

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of "YHCRA" and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.^[15]

FALLCHILL encrypts C2 data with RC4 encryption.^[36]

FatDuke can AES encrypt C2 communications.^[37]

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.^[38]

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.^[39]

Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.^[40]

Gazer uses custom encryption for C2 that uses 3DES.^[41][42]

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.^[43]

GreyEnergy encrypts communications using AES256.^[44]

H1N1 encrypts C2 traffic using an RC4 key.^[45]

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.^[46]

Helminth encrypts data sent to its C2 server over HTTP with RC4.^[47]

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.^[48]

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.^[49]

Hikit performs XOR encryption.^[50]

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.^[51][52]

httpclient encrypts C2 content with XOR using a single byte, 0x12.^[1]

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.^[53]

Inception has encrypted network communications with AES.^[54]

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.^[55]

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.^[56]

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.^[57]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.^{[58][59][60][61]}

LightNeuron uses AES to encrypt C2 traffic.^[62]

Lurid performs XOR encryption.^[63]

Machete has used AES to exfiltrate documents.^[64]

MoonWind encrypts C2 traffic using RC4 with a static key.^[65]

More_eggs has used an RC4-based encryption method for its C2 communications.^[66]

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.^[67]

NanoCore uses DES to encrypt the C2 traffic.^[68]

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.^[10]

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."^[69]

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ^[70]

PipeMon communications are RC4 encrypted.^[71]

PLAINTEE encodes C2 beacons using XOR.^[72]

PLEAD has used RC4 encryption to download modules.^[73]

PoisonIvy uses the Camellia cipher to encrypt communications.^[74]

POWERTON has used AES for encrypting C2 traffic.^[4]

Prikormka encrypts some C2 traffic with the Blowfish cipher.^[75]

QuasarRAT uses AES to encrypt network communication.^[76][77]

RDAT has used AES ciphertext to encode C2 communications.^[78]

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.^[79]

Rifdoor has encrypted command and control (C2) communications with a stream cipher.^[51]

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.^[80]

RTM encrypts C2 traffic with a custom RC4 variant.^[81]

Sakula encodes C2 traffic with single-byte XOR keys.^[82]

SeaDuke C2 traffic has been encrypted with RC4 and AES.^[83][84]

SNUGRIDE encrypts C2 traffic using AES with a static key.^[85]

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.^[86]

Sunburst encrypted C2 traffic using a single-byte-XOR cipher.^[87]

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.^[88]

Taidoor uses RC4 to encrypt the message body of HTTP content.^[89]

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.^[90]

TSCookie has encrypted network communications with RC4.^[91]

Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.^[92]

Volgmer uses a simple XOR cipher to encrypt traffic and files.^[93]

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.^[94][95][96]

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).^[97]

ZeroT has used RC4 to encrypt C2 traffic.^[98][99]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.