Encrypted Channel: Symmetric Cryptography

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails^[8]

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.^[8]

A variant of ADVSTORESHELL encrypts some C2 with 3DES.^[32]

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.^[88]

APT33 has used AES for encryption of command and control traffic.^[64]

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.^[80]

Azorult can encrypt C2 traffic using XOR.^[50][51]

BADCALL encrypts C2 traffic using an XOR/ADD cipher.^[52]

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.^[19][20]

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.^[35]

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.^[36]

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.^[5]

CallMe uses AES to encrypt C2 traffic.^[7]

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.^[12][13]

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.^[53]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[17]

ChChes can encrypt C2 traffic with AES or RC4.^[46][47]

CHOPSTICK encrypts C2 communications with RC4.^[9]

Comnie encrypts command and control communications with RC4.^[29]

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.^[33]

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.^[24]

Daserf uses RC4 encryption to obfuscate HTTP traffic.^[5]

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.^[11]

Dipsind encrypts C2 data with AES256 in ECB mode.^[26]

down_new has the ability to AES encrypt C2 communications.^[82]

Downdelph uses RC4 to encrypt C2 responses.^[60]

Dridex has encrypted traffic with RC4.^[67]

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.^[61]

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.^[65]

Elise encrypts exfiltrated data with RC4.^[34]

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.^[56]

Epic encrypts commands from the C2 server using a hardcoded key.^[49]

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of "YHCRA" and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.^[7]

FALLCHILL encrypts C2 data with RC4 encryption.^[18]

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.^[55]

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.^[66]

Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.^[90]

Gazer uses custom encryption for C2 that uses 3DES.^[72][73]

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.^[44]

GreyEnergy encrypts communications using AES256.^[45]

H1N1 encrypts C2 traffic using an RC4 key.^[3]

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.^[28]

Helminth encrypts data sent to its C2 server over HTTP with RC4.^[39]

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.^[74]

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.^[68]

Hikit performs XOR encryption.^[31]

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.^[76][77]

httpclient encrypts C2 content with XOR using a single byte, 0x12.^[8]

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.^[27]

Inception has encrypted network communications with AES.^[89]

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.^[57]

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.^[41]

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.^[25]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.^{[84][85][86][87]}

LightNeuron uses AES to encrypt C2 traffic.^[69]

Lurid performs XOR encryption.^[4]

MoonWind encrypts C2 traffic using RC4 with a static key.^[10]

More_eggs has used an RC4-based encryption method for its C2 communications.^[70]

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.^[58]

NanoCore uses DES to encrypt the C2 traffic.^[43]

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.^[20]

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."^[15]

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ^[81]

PLAINTEE encodes C2 beacons using XOR.^[42]

PLEAD has used RC4 encryption to download modules.^[78]

PoisonIvy uses the Camellia cipher to encrypt communications.^[23]

POWERTON has used AES for encrypting C2 traffic.^[64]

Prikormka encrypts some C2 traffic with the Blowfish cipher.^[48]

QuasarRAT uses AES to encrypt network communication.^[1][2]

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.^[38]

Rifdoor has encrypted command and control (C2) communications with a stream cipher.^[76]

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.^[6]

RTM encrypts C2 traffic with a custom RC4 variant.^[30]

Sakula encodes C2 traffic with single-byte XOR keys.^[37]

SeaDuke C2 traffic has been encrypted with RC4 and AES.^[21][22]

SNUGRIDE encrypts C2 traffic using AES with a static key.^[14]

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.^[83]

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.^[59]

Taidoor uses RC4 to encrypt the message body of HTTP content.^[71]

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.^[16]

TSCookie has encrypted network communications with RC4.^[79]

Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.^[54]

Volgmer uses a simple XOR cipher to encrypt traffic and files.^[40]

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).^[75]

ZeroT has used RC4 to encrypt C2 traffic.^[62][63]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.