Windows Malware Development Part 5: Payload Encryption - RC4
Objective
Hey guys, welcome to the fifth part of Windows Malware Development, in which we will look at how to encrypt our malicious shellcode using the RC4 cryptographic algorithm.
Payload Encryption
Malware authors use encryption algorithms to hide the malicious content placed inside a binary. Encryption can help beat signature-based detection, but has a higher chance of failing against other detection mechanisms such as run-time analysis.
RC4 Encryption
RC4 is a stream cipher that shines when it comes to speed and efficiency. Another handy trait about it is that the function responsible for encryption can also be used for decryption. We won’t be going in too much detail when it comes to the internals, but this is all the necessary information needed to accomplish our task.
There are multiple methods that can be used to perform RC4 encryption, ranging from simple implementations to advanced. However, in this post, we will be looking at something interesting; using an undocumented NTAPI.
