reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/decrypting-embedded-configuration/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: decrypting-embedded-configuration
+description: 'Decrypts statically embedded malware configuration blobs by trying common schemes
+  (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like
+  content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a
+  blob, or brute-force a configuration encryption scheme.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - config-extraction
+  - decryption
+  - xor
+  - rc4
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1140
+  - T1027
+  - T1071
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/'
+  - 'RC4 algorithm (RFC-equivalent public description) — https://en.wikipedia.org/wiki/RC4'
+---
+
+# Decrypting Embedded Configuration
+
+## When to Use
+
+- You have an extracted config blob (from a resource, `.data` section, or overlay) that is XOR/RC4/
+  base64-obfuscated and want to recover plaintext settings.
+- You need a quick brute-force over common schemes before writing a family-specific decryptor.
+
+**Do not use** this on a live-decrypted-in-memory config — for that use the memory config skill.
+This works statically on the extracted blob and executes nothing.
+
+## Prerequisites
+
+- The extracted ciphertext blob and (optionally) a candidate key.
+
+## Safety & Handling
+
+- Treat decoded endpoints as live C2; defang before sharing.
+
+## Workflow
+
+### Step 1: Try single-byte XOR
+
+```bash
+python scripts/analyst.py xor blob.bin
+```
+
+Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens
+(`http`, `.php`, IP patterns, `id=`).
+
+### Step 2: Try RC4 / multi-byte XOR with a key
+
+```bash
+python scripts/analyst.py rc4 blob.bin --key mysecret
+python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33
+```
+
+### Step 3: Peel base64 / repeat
+
+If output is base64, decode and re-run the scheme search on the result.
+
+### Step 4: Extract and defang
+
+Pull URLs/IPs/keys from the best-scoring plaintext and defang.
+
+## Validation
+
+- The chosen scheme yields a high printable ratio and real config tokens.
+- Recovered endpoints parse as valid hosts/URLs.
+- Output is defanged before sharing.
+
+## Pitfalls
+
+- Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables.
+- RC4 key drop-bytes variants (RC4-drop) needed by some families.
+- Nested layers (base64 over XOR over RC4) requiring multiple passes.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the decryptor.
+- ATT&CK T1140 and the RC4 description (linked in frontmatter).