value:  FrameworkPOS can XOR credit card information before exfiltration. ;; HAWKBALL has encrypted data with XOR before sending it over the C2 channel. ;; InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration. ;; Kimsuky has used RC4 encryption before exfil. ;; A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration. ;; Machete's collected data is encrypted with AES before exfiltration. ;; MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. ;; Mustang Panda has encrypted documents with RC4 prior to exfiltration. ;; NETWIRE has used a custom encryption algorithm to encrypt collected data. ;; Okrum has used a custom implementation of AES encryption to encrypt collected data. ;; OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server. ;; OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file. ;; Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR. ;; RawPOS encodes credit card data it collected from the victim with XOR. ;; Reaver encrypts collected data with an incremental XOR key prior to exfiltration. ;; RGDoor encrypts files with XOR before sending them back to the C2 server. ;; Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration. ;; Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23. ;; StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme. ;; T9000 encrypts collected data using a single byte XOR key.
name: Archive Collected Data: Archive Via Custom Method