Archive Collected Data: Archive via Custom Method

ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.^[1]

Agent.btz saves system information into an XML file that is then XOR-encoded.^[2]

Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.^[3]

BLUELIGHT has encoded data into a binary blob using XOR.^[4]

During C0017, APT41 hex-encoded PII data prior to exfiltration.^[5]

CopyKittens encrypts data with a substitute cipher prior to exfiltration.^[6]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[7]

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.^[8][9]

FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.^[10]

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.^[11]

FrameworkPOS can XOR credit card information before exfiltration.^[12]

FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or qwerasdf if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.^[13]

HAWKBALL has encrypted data with XOR before sending it over the C2 channel.^[14]

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.^[15]

Kimsuky has used RC4 encryption before exfil.^[16]

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.^{[17][18][19][20]}

Lotus Blossom has used custom tools to compress and archive data on victim systems.^[21]

Machete's collected data is encrypted with AES before exfiltration.^[22]

MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. ^[23]

metaMain has used XOR-based encryption for collected files before exfiltration.^[24]

Mustang Panda has encrypted documents with RC4 prior to exfiltration.^[25]

NETWIRE has used a custom encryption algorithm to encrypt collected data.^[26]

Okrum has used a custom implementation of AES encryption to encrypt collected data.^[27]

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.^[28]

OSX_OCEANLOTUS.D has used AES in CBC mode to encrypt collected data when saving that data to disk.^[29]

OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.^[30]

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.^[31]

RawPOS encodes credit card data it collected from the victim with XOR.^[32][33][34]

Reaver encrypts collected data with an incremental XOR key prior to exfiltration.^[35]

RGDoor encrypts files with XOR before sending them back to the C2 server.^[36]

Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.^[37]

SombRAT has encrypted collected data with AES-256 using a hardcoded key.^[38]

Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.^[10]

Squirrelwaffle has encrypted collected data using a XOR-based algorithm.^[39]

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.^[40][41]

Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.^[42]

SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.^[43]

T9000 encrypts collected data using a single byte XOR key.^[44]

UNC3886 has XOR encrypted and Gzip compressed captured credentials.^[45]