reverse-skills-max/vendor-new/analyst-ai-pack/skills/decrypting-embedded-configuration/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
decrypting-embedded-configuration	Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.	cybersecurity	reverse-engineering	reverse-engineering config-extraction decryption xor rc4	1.0.0	analyst-ai-pack	Apache-2.0	T1140 T1027 T1071	D3-SDA D3-DA	MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/ RC4 algorithm (RFC-equivalent public description) — https://en.wikipedia.org/wiki/RC4

Decrypting Embedded Configuration

When to Use

• You have an extracted config blob (from a resource, .data section, or overlay) that is XOR/RC4/ base64-obfuscated and want to recover plaintext settings.
• You need a quick brute-force over common schemes before writing a family-specific decryptor.

Do not use this on a live-decrypted-in-memory config — for that use the memory config skill. This works statically on the extracted blob and executes nothing.

Prerequisites

• The extracted ciphertext blob and (optionally) a candidate key.

Safety & Handling

• Treat decoded endpoints as live C2; defang before sharing.

Workflow

Step 1: Try single-byte XOR

python scripts/analyst.py xor blob.bin

Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens (http, .php, IP patterns, id=).

Step 2: Try RC4 / multi-byte XOR with a key

python scripts/analyst.py rc4 blob.bin --key mysecret
python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33

Step 3: Peel base64 / repeat

If output is base64, decode and re-run the scheme search on the result.

Step 4: Extract and defang

Pull URLs/IPs/keys from the best-scoring plaintext and defang.

Validation

• The chosen scheme yields a high printable ratio and real config tokens.
• Recovered endpoints parse as valid hosts/URLs.
• Output is defanged before sharing.

Pitfalls

• Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables.
• RC4 key drop-bytes variants (RC4-drop) needed by some families.
• Nested layers (base64 over XOR over RC4) requiring multiple passes.

References

• See references/api-reference.md for the decryptor.
• ATT&CK T1140 and the RC4 description (linked in frontmatter).