Crypto techniques

← maldev README · docs/index

The crypto/ package supplies confidentiality and signature-breaking primitives for payload protection. Two surfaces sit side-by-side: strong AEAD ciphers for the outer envelope, and lightweight transforms for layered unpackers and signature defeat.

[!NOTE] Encoding (Base64, UTF-16LE, PowerShell -EncodedCommand) lives in docs/techniques/encode. Hashing (cryptographic + fuzzy + ROR13) lives in docs/techniques/hash.

TL;DR

flowchart LR
    SC[shellcode] -->|EncryptAESGCM| ENV[encrypted envelope]
    ENV -->|optional layers| OBF[XTEA / S-Box / Matrix]
    OBF --> EMBED[ship in implant]
    EMBED -.runtime.-> DEC[DecryptAESGCM]
    DEC --> WIPE[memory.SecureZero key]
    WIPE --> RUN[inject.Inject]

Build-time: encrypt with AES-256-GCM (or XChaCha20-Poly1305), optionally wrap in 1–2 lightweight obfuscation layers, embed in the implant. Runtime: decrypt → wipe key → inject → wipe plaintext.

Packages

PackageTech pageDetectionOne-liner
cryptopayload-encryption.mdvery-quietAEAD (AES-GCM, ChaCha20), stream/block (RC4, TEA, XTEA), signature-breaking transforms (S-Box, Matrix, XOR, ArithShift)

The package mixes three layers; the technique page documents each layer separately.

Quick decision tree

You want to…Use
…encrypt the outer payload envelopecrypto.EncryptAESGCM (preferred) or crypto.EncryptChaCha20
…generate a sane keycrypto.NewAESKey / crypto.NewChaCha20Key
…break a YARA byte signature without changing semanticscrypto.NewSBox + SubstituteBytes
…add a tiny in-process unpacker stagecrypto.EncryptXTEA
…diffuse byte patterns across a block (Hill cipher)crypto.MatrixTransform
…match a legacy Metasploit handlercrypto.EncryptRC4 (cryptographically broken — compatibility only)
…compute SHA-256 / MD5 / ROR13hash package
…Base64 / UTF-16LE / PowerShell-encodeencode package

MITRE ATT&CK

T-IDNamePackagesD3FEND counter
T1027Obfuscated Files or Informationcrypto (XOR, TEA, S-Box, Matrix, ArithShift)D3-SEA (Static Executable Analysis)
T1027.013Encrypted/Encoded Filecrypto (AES-GCM, ChaCha20, RC4)D3-FCR (File Content Rules)

See also