Encryption with no separate external key
- Monday, August 30, 2010, 17:33
- Threat Research
Most typical modern malware variants tend to hide critical parts of their functionality (strings, URLs/IPs of its dodgy servers, etc.) using some form of encryption. In most cases only trivial algorithms are used. However, these suffice as the intention is usually not to create unbreakable encryption, but merely to obscure their malicious intent from anti-virus engines.
Although some authors choose to cloak their malware in complete paranoia, such as the ZBot family that encrypts everything with an industry-standard RC4 implementation with enormously long keys, typically, you would not find anything more serious (such as AES, or BlowFish) even in the most complex of polymorphic viruses.
The most overwhelmingly-common method of string encryption is to use an XOR operation with a key. A big appeal of this technique is that the same simple operation can be used to perform both encryption and subsequently decryption of the data, ie: E = (E Xor Key) Xor Key.
But sometimes it is not just simple, its even more than simple - where there is no need for ANY decryption key to decrypt data!
While analyzing one of the recent samples, I found a very curious encrypted string (hexadecimal representation):
67 02 11 17 0C 01 08 0F 0E 49 5E 18 18
In the line above there is one single encrypted string. You don’t need any additional key to decrypt (continue reading...)