An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.^[1]

ID: T1560.003

Sub-technique of: T1560

Tactic: Collection

Platforms: Linux, Windows, macOS

Version: 1.0

Created: 20 February 2020

Last Modified: 25 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
ADVSTORESHELL	ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.^[1]
Agent.btz	Agent.btz saves system information into an XML file that is then XOR-encoded.^[5]
Attor	Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.^[16]
CopyKittens	CopyKittens encrypts data with a substitute cipher prior to exfiltration.^[22]
Duqu	Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[3]
FIN6	TRINITY malware used by FIN6 encodes data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key.^[21]
FLASHFLOOD	FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.^[7]
HAWKBALL	HAWKBALL has encrypted data with XOR before sending it over the C2 channel.^[13]
InvisiMole	InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.^[2]
Kimsuky	Kimsuky has used RC4 encryption before exfil.^[23]
Lazarus Group	A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.^[24]^[25]^[26]^[27]
Machete	Machete's collected data is encrypted with AES before exfiltration.^[14]
MESSAGETAP	MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. ^[18]
Okrum	Okrum has used a custom implementation of AES encryption to encrypt collected data.^[17]
OopsIE	OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.^[15]
OwaAuth	OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.^[4]
Ramsay	Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.^[20]
RawPOS	RawPOS encodes credit card data it collected from the victim with XOR.^[10]^[11]^[12]
Reaver	Reaver encrypts collected data with an incremental XOR key prior to exfiltration.^[9]
RGDoor	RGDoor encrypts files with XOR before sending them back to the C2 server.^[6]
Rising Sun	Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.^[19]
SPACESHIP	Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.^[7]
T9000	T9000 encrypts collected data using a single byte XOR key.^[8]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Custom archival methods can be very difficult to detect, since many of them use standard programming language concepts, such as bitwise operations.

Archive Collected Data: Archive via Custom Method

Other sub-techniques of Archive Collected Data (3)

Procedure Examples

Mitigations

Detection

References