Archive Collected Data: Archive via Custom Method

ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.^[1]

Agent.btz saves system information into an XML file that is then XOR-encoded.^[2]

Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.^[3]

BLUELIGHT has encoded data into a binary blob using XOR.^[4]

CopyKittens encrypts data with a substitute cipher prior to exfiltration.^[5]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[6]

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.^[7][8]

FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.^[9]

FrameworkPOS can XOR credit card information before exfiltration.^[10]

HAWKBALL has encrypted data with XOR before sending it over the C2 channel.^[11]

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.^[12]

Kimsuky has used RC4 encryption before exfil.^[13]

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.^{[14][15][16][17]}

Machete's collected data is encrypted with AES before exfiltration.^[18]

MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. ^[19]

Mustang Panda has encrypted documents with RC4 prior to exfiltration.^[20]

NETWIRE has used a custom encryption algorithm to encrypt collected data.^[21]

Okrum has used a custom implementation of AES encryption to encrypt collected data.^[22]

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.^[23]

OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.^[24][25]

OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.^[26]

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.^[27]

RawPOS encodes credit card data it collected from the victim with XOR.^[28][29][30]

Reaver encrypts collected data with an incremental XOR key prior to exfiltration.^[31]

RGDoor encrypts files with XOR before sending them back to the C2 server.^[32]

Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.^[33]

Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.^[9]

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.^[34][35]

Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.^[36]

T9000 encrypts collected data using a single byte XOR key.^[37]