Archive Collected Data: Archive via Custom Method

ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.^[1]

Agent.btz saves system information into an XML file that is then XOR-encoded.^[2]

Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.^[3]

BLUELIGHT has encoded data into a binary blob using XOR.^[4]

CopyKittens encrypts data with a substitute cipher prior to exfiltration.^[5]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[6]

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.^[7][8]

FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.^[9]

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.^[10]

FrameworkPOS can XOR credit card information before exfiltration.^[11]

HAWKBALL has encrypted data with XOR before sending it over the C2 channel.^[12]

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.^[13]

Kimsuky has used RC4 encryption before exfil.^[14]

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.^{[15][16][17][18]}

Machete's collected data is encrypted with AES before exfiltration.^[19]

MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list. ^[20]

Mustang Panda has encrypted documents with RC4 prior to exfiltration.^[21]

NETWIRE has used a custom encryption algorithm to encrypt collected data.^[22]

Okrum has used a custom implementation of AES encryption to encrypt collected data.^[23]

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.^[24]

OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.^[25][26]

OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.^[27]

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.^[28]

RawPOS encodes credit card data it collected from the victim with XOR.^[29][30][31]

Reaver encrypts collected data with an incremental XOR key prior to exfiltration.^[32]

RGDoor encrypts files with XOR before sending them back to the C2 server.^[33]

Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.^[34]

Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.^[9]

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.^[35][36]

Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.^[37]

T9000 encrypts collected data using a single byte XOR key.^[38]