Encrypted Channel: Symmetric Cryptography

3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails^[1]

4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.^[1]

A variant of ADVSTORESHELL encrypts some C2 with 3DES.^[2]

APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.^[3]

APT33 has used AES for encryption of command and control traffic.^[4]

Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.^[5]

Azorult can encrypt C2 traffic using XOR.^[6][7]

BADCALL encrypts C2 traffic using an XOR/ADD cipher.^[8]

BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.^[9][10]

Bandook has used AES encryption for C2 communication.^[11]

Bazar can send C2 communications with XOR encryption.^[12]

BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.^[13]

BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.^[14]

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.^[15][16]

BLINDINGCAN has encrypted its C2 traffic with RC4.^[17]

Bonadan can XOR-encrypt C2 communications.^[18]

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.^[19]

CallMe uses AES to encrypt C2 traffic.^[20]

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.^[21][22]

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.^[23]

Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.^[24]

ChChes can encrypt C2 traffic with AES or RC4.^[25][26]

CHOPSTICK encrypts C2 communications with RC4.^[27]

Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.^[28]

Comnie encrypts command and control communications with RC4.^[29]

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.^[30]

CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.^[31]

Darkhotel has used AES-256 and 3DES for C2 communications.^[32]

Daserf uses RC4 encryption to obfuscate HTTP traffic.^[19]

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.^[33]

Dipsind encrypts C2 data with AES256 in ECB mode.^[34]

down_new has the ability to AES encrypt C2 communications.^[35]

Downdelph uses RC4 to encrypt C2 responses.^[36]

Dridex has encrypted traffic with RC4.^[37]

The Duqu command and control protocol's data stream can be encrypted with AES-CBC.^[38]

Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.^[39]

Elise encrypts exfiltrated data with RC4.^[40]

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.^[41]

Epic encrypts commands from the C2 server using a hardcoded key.^[42]

Explosive has encrypted communications with the RC4 method.^[43]

The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of "YHCRA" and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.^[20]

FALLCHILL encrypts C2 data with RC4 encryption.^[44][45]

FatDuke can AES encrypt C2 communications.^[46]

Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.^[47]

FlawedAmmyy has used SEAL encryption during the initial C2 handshake.^[48]

Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.^[49]

Gazer uses custom encryption for C2 that uses 3DES.^[50][51]

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.^[52]

GreyEnergy encrypts communications using AES256.^[53]

GrimAgent can use an AES key to encrypt C2 communications.^[54]

H1N1 encrypts C2 traffic using an RC4 key.^[55]

Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.^[56]

Helminth encrypts data sent to its C2 server over HTTP with RC4.^[57]

Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.^[58]

HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.^[59]

Higaisa used AES-128 to encrypt C2 traffic.^[60]

Hikit performs XOR encryption.^[61]

HotCroissant has compressed network communications and encrypted them with a custom stream cipher.^[62][63]

httpclient encrypts C2 content with XOR using a single byte, 0x12.^[1]

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.^[64]

HyperStack has used RSA encryption for C2 communications.^[65]

Inception has encrypted network communications with AES.^[66]

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.^[67]

KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.^[68]

Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.^[69][70]

The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.^[71]

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.^{[72][73][74][75]}

LightNeuron uses AES to encrypt C2 traffic.^[76]

LookBack uses a modified version of RC4 for data transfer.^[77]

Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.^[78]

Lurid performs XOR encryption.^[79]

Machete has used AES to exfiltrate documents.^[80]

Metamorfo has encrypted C2 commands with AES-256.^[81]

MoonWind encrypts C2 traffic using RC4 with a static key.^[82]

More_eggs has used an RC4-based encryption method for its C2 communications.^[83]

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.^[84]

Mustang Panda has encrypted C2 communications with RC4.^[85]

NanoCore uses DES to encrypt the C2 traffic.^[86]

NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.^[10]

Nebulae can use RC4 and XOR to encrypt C2 communications.^[87]

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."^[88]

NETWIRE can use AES encryption for C2 data transferred.^[89]

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ^[90]

PipeMon communications are RC4 encrypted.^[91]

PLAINTEE encodes C2 beacons using XOR.^[92]

PLEAD has used RC4 encryption to download modules.^[93]

PoisonIvy uses the Camellia cipher to encrypt communications.^[94]

POWERTON has used AES for encrypting C2 traffic.^[4]

Prikormka encrypts some C2 traffic with the Blowfish cipher.^[95]

QakBot can RC4 encrypt strings in C2 communication.^[96]

QuasarRAT uses AES to encrypt network communication.^[97][98]

RainyDay can use RC4 to encrypt C2 communications.^[87]

RDAT has used AES ciphertext to encode C2 communications.^[99]

RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.^[100]

Rifdoor has encrypted command and control (C2) communications with a stream cipher.^[62]

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.^[101]

RTM encrypts C2 traffic with a custom RC4 variant.^[102]

Sakula encodes C2 traffic with single-byte XOR keys.^[103]

SeaDuke C2 traffic has been encrypted with RC4 and AES.^[104][105]

SideTwist can encrypt C2 communications with a randomly generated key.^[106]

Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.^[107]

SMOKEDHAM has encrypted its C2 traffic with RC4.^[108]

SNUGRIDE encrypts C2 traffic using AES with a static key.^[109]

SodaMaster can use RC4 to encrypt C2 communications.^[110]

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.^[111]

Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.^[112]

SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.^[113]

Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.^[114]

Taidoor uses RC4 to encrypt the message body of HTTP content.^[115][116]

TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.^[117]

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.^[118]Newer versions of TrickBot have been known to use bcrypt to encrypt and digitally sign responses to their C2 server. ^[119]

TSCookie has encrypted network communications with RC4.^[120]

Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.^[121]

Volgmer uses a simple XOR cipher to encrypt traffic and files.^[122]

WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.^{[123][124][125]}

Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).^[126]

xCaon has encrypted data sent to the C2 server using a XOR key.^[127]

XCSSET uses RC4 encryption over TCP to communicate with its C2 server.^[128]

ZeroT has used RC4 to encrypt C2 traffic.^[129][130]

ZIRCONIUM has used AES encrypted communications in C2.^[131]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.