value:  BADCALL encrypts C2 traffic using an XOR/ADD cipher. ;; BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23. ;; Bazar can send C2 communications with XOR encryption. ;; BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP. ;; BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks. ;; Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4. ;; BLINDINGCAN has encrypted its C2 traffic with RC4. ;; Bonadan can XOR-encrypt C2 communications. ;; BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server. ;; CallMe uses AES to encrypt C2 traffic. ;; Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications. ;; Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic. ;; Chaos provides a reverse shell connection on 8338/TCP encrypted via AES. ;; ChChes can encrypt C2 traffic with AES or RC4. ;; CHOPSTICK encrypts C2 communications with RC4. ;; Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data. ;; Comnie encrypts command and control communications with RC4. ;; CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys. ;; CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error. ;; Darkhotel has used AES-256 and 3DES for C2 communications. ;; Daserf uses RC4 encryption to obfuscate HTTP traffic. ;; Derusbi obfuscates C2 traffic with variable 4-byte XOR keys. ;; Dipsind encrypts C2 data with AES256 in ECB mode. ;; down_new has the ability to AES encrypt C2 communications. ;; Downdelph uses RC4 to encrypt C2 responses. ;; Dridex has encrypted traffic with RC4. ;; The Duqu command and control protocol's data stream can be encrypted with AES-CBC. ;; Ebury has encrypted C2 traffic using the client IP address then encoded it as a hexadecimal string. ;; Elise encrypts exfiltrated data with RC4. ;; The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data. ;; Epic encrypts commands from the C2 server using a hardcoded key. ;; Explosive has encrypted communications with the RC4 method. ;; The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic. ;; FALLCHILL encrypts C2 data with RC4 encryption. ;; FatDuke can AES encrypt C2 communications. ;; Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys. ;; FlawedAmmyy has used SEAL encryption during the initial C2 handshake. ;; Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC. ;; Gazer uses custom encryption for C2 that uses 3DES. ;; gh0st RAT uses RC4 and XOR to encrypt C2 traffic. ;; GreyEnergy encrypts communications using AES256. ;; H1N1 encrypts C2 traffic using an RC4 key. ;; Before being appended to image files HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands an investigator would need access to the intended malware sample the day's tweet and the image file containing the command. ;; Helminth encrypts data sent to its C2 server over HTTP with RC4. ;; Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys. ;; HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication. ;; Higaisa used AES-128 to encrypt C2 traffic. ;; Hikit performs XOR encryption. ;; HotCroissant has compressed network communications and encrypted them with a custom stream cipher. ;; httpclient encrypts C2 content with XOR using a single byte 0x12. ;; Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations. ;; HyperStack has used RSA encryption for C2 communications. ;; Inception has encrypted network communications with AES. ;; InvisiMole uses variations of a simple XOR encryption routine for C&C communications. ;; KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications. ;; The Komplex C2 channel uses an 11-byte XOR algorithm to hide data. ;; Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. ;; LightNeuron uses AES to encrypt C2 traffic. ;; LookBack uses a modified version of RC4 for data transfer. ;; Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire. ;; Lurid performs XOR encryption. ;; Machete has used AES to exfiltrate documents. ;; MoonWind encrypts C2 traffic using RC4 with a static key. ;; More_eggs has used an RC4-based encryption method for its C2 communications. ;; Mosquito uses a custom encryption algorithm which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm. ;; Mustang Panda has encrypted C2 communications with RC4. ;; NanoCore uses DES to encrypt the C2 traffic. ;; NDiskMonitor uses AES to encrypt certain information sent over its C2 channel. ;; NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key ScoutEagle." ;; NETWIRE can use AES encryption for C2 data transferred. ;; Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ;; PipeMon communications are RC4 encrypted. ;; PLAINTEE encodes C2 beacons using XOR. ;; PLEAD has used RC4 encryption to download modules. ;; PoisonIvy uses the Camellia cipher to encrypt communications. ;; POWERTON has used AES for encrypting C2 traffic. ;; Prikormka encrypts some C2 traffic with the Blowfish cipher. ;; QuasarRAT uses AES to encrypt network communication. ;; RDAT has used AES ciphertext to encode C2 communications. ;; RedLeaves has encrypted C2 traffic with RC4 previously using keys of 88888888 and babybear. ;; Rifdoor has encrypted command and control (C2) communications with a stream cipher. ;; APT12 has used the RIPTIDE RAT which communicates over HTTP with a payload encrypted with RC4. ;; RTM encrypts C2 traffic with a custom RC4 variant. ;; Sakula encodes C2 traffic with single-byte XOR keys. ;; SeaDuke C2 traffic has been encrypted with RC4 and AES. ;; SNUGRIDE encrypts C2 traffic using AES with a static key. ;; Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key. ;; SUNBURST encrypted C2 traffic using a single-byte-XOR cipher. ;; Sys10 uses an XOR 0x1 loop to encrypt its C2 domain. ;; Taidoor uses RC4 to encrypt the message body of HTTP content. ;; TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption. ;; TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic. ;; TSCookie has encrypted network communications with RC4. ;; Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. ;; Volgmer uses a simple XOR cipher to encrypt traffic and files. ;; WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key. ;; Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2). ;; ZeroT has used RC4 to encrypt C2 traffic. ;; ZIRCONIUM has used AES encrypted communications in C2."
name: Encrypted Channel: Symmetric Cryptography