91 lines
2.8 KiB
Markdown
91 lines
2.8 KiB
Markdown
---
|
|
name: decrypting-embedded-configuration
|
|
description: 'Decrypts statically embedded malware configuration blobs by trying common schemes
|
|
(single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like
|
|
content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a
|
|
blob, or brute-force a configuration encryption scheme.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- config-extraction
|
|
- decryption
|
|
- xor
|
|
- rc4
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1140
|
|
- T1027
|
|
- T1071
|
|
d3fend:
|
|
- D3-SDA
|
|
- D3-DA
|
|
references:
|
|
- 'MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/'
|
|
- 'RC4 algorithm (RFC-equivalent public description) — https://en.wikipedia.org/wiki/RC4'
|
|
---
|
|
|
|
# Decrypting Embedded Configuration
|
|
|
|
## When to Use
|
|
|
|
- You have an extracted config blob (from a resource, `.data` section, or overlay) that is XOR/RC4/
|
|
base64-obfuscated and want to recover plaintext settings.
|
|
- You need a quick brute-force over common schemes before writing a family-specific decryptor.
|
|
|
|
**Do not use** this on a live-decrypted-in-memory config — for that use the memory config skill.
|
|
This works statically on the extracted blob and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- The extracted ciphertext blob and (optionally) a candidate key.
|
|
|
|
## Safety & Handling
|
|
|
|
- Treat decoded endpoints as live C2; defang before sharing.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Try single-byte XOR
|
|
|
|
```bash
|
|
python scripts/analyst.py xor blob.bin
|
|
```
|
|
|
|
Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens
|
|
(`http`, `.php`, IP patterns, `id=`).
|
|
|
|
### Step 2: Try RC4 / multi-byte XOR with a key
|
|
|
|
```bash
|
|
python scripts/analyst.py rc4 blob.bin --key mysecret
|
|
python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33
|
|
```
|
|
|
|
### Step 3: Peel base64 / repeat
|
|
|
|
If output is base64, decode and re-run the scheme search on the result.
|
|
|
|
### Step 4: Extract and defang
|
|
|
|
Pull URLs/IPs/keys from the best-scoring plaintext and defang.
|
|
|
|
## Validation
|
|
|
|
- The chosen scheme yields a high printable ratio and real config tokens.
|
|
- Recovered endpoints parse as valid hosts/URLs.
|
|
- Output is defanged before sharing.
|
|
|
|
## Pitfalls
|
|
|
|
- Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables.
|
|
- RC4 key drop-bytes variants (RC4-drop) needed by some families.
|
|
- Nested layers (base64 over XOR over RC4) requiring multiple passes.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the decryptor.
|
|
- ATT&CK T1140 and the RC4 description (linked in frontmatter).
|