Skip to content

README.md

Latest commit

 

History

History
79 lines (62 loc) · 4.09 KB

README.md

File metadata and controls

79 lines (62 loc) · 4.09 KB
last_reviewed 2026-04-27
reflects_commit f815d85

Crypto techniques

← maldev README · docs/index

The crypto/ package supplies confidentiality and signature-breaking primitives for payload protection. Two surfaces sit side-by-side: strong AEAD ciphers for the outer envelope, and lightweight transforms for layered unpackers and signature defeat.

Note

Encoding (Base64, UTF-16LE, PowerShell -EncodedCommand) lives in docs/techniques/encode. Hashing (cryptographic + fuzzy + ROR13) lives in docs/techniques/hash.

TL;DR

flowchart LR
    SC[shellcode] -->|EncryptAESGCM| ENV[encrypted envelope]
    ENV -->|optional layers| OBF[XTEA / S-Box / Matrix]
    OBF --> EMBED[ship in implant]
    EMBED -.runtime.-> DEC[DecryptAESGCM]
    DEC --> WIPE[memory.SecureZero key]
    WIPE --> RUN[inject.Inject]
Loading

Build-time: encrypt with AES-256-GCM (or XChaCha20-Poly1305), optionally wrap in 1–2 lightweight obfuscation layers, embed in the implant. Runtime: decrypt → wipe key → inject → wipe plaintext.

Packages

Package Tech page Detection One-liner
crypto payload-encryption.md very-quiet AEAD (AES-GCM, ChaCha20), stream/block (RC4, TEA, XTEA), signature-breaking transforms (S-Box, Matrix, XOR, ArithShift)

The package mixes three layers; the technique page documents each layer separately.

For a side-by-side comparison of every primitive (Layer / Speed / Entropy / Key size / IV / Authenticated / Reversible / Static signature / Best-for), see the "Pick the primitive" 9-row matrix in payload-encryption.md. The matrix is the canonical place to make a "which cipher / transform do I reach for?" choice; the decision tree below is a quick-reference shortcut.

Quick decision tree

You want to… Use
…encrypt the outer payload envelope crypto.EncryptAESGCM (preferred) or crypto.EncryptChaCha20
…generate a sane key crypto.NewAESKey / crypto.NewChaCha20Key
…break a YARA byte signature without changing semantics crypto.NewSBox + SubstituteBytes
…add a tiny in-process unpacker stage crypto.EncryptXTEA
…diffuse byte patterns across a block (Hill cipher) crypto.MatrixTransform
…match a legacy Metasploit handler crypto.EncryptRC4 (cryptographically broken — compatibility only)
…compute SHA-256 / MD5 / ROR13 hash package
…Base64 / UTF-16LE / PowerShell-encode encode package

MITRE ATT&CK

T-ID Name Packages D3FEND counter
T1027 Obfuscated Files or Information crypto (XOR, TEA, S-Box, Matrix, ArithShift) D3-SEA (Static Executable Analysis)
T1027.013 Encrypted/Encoded File crypto (AES-GCM, ChaCha20, RC4) D3-FCR (File Content Rules)

See also