Learning Malware Analysis

1.3.2 Finding XOR Key Through Brute-Force

In a single byte XOR, the length of the key is one byte, so there can be only 255 possible keys (0x0 - 0xff) with the exception of 0 as the key because XORing any value with 0 will give the same value as result (that is, no encryption). Since there are only 255 keys, you can try all possible keys on the encrypted data. This technique is useful if you know what to find in the decrypted data. For example, upon executing a malware sample, let's say the malware gets the computer hostname mymachine and concatenates with some data and performs single byte xor encryption, which encrypts it to a ciphertext lkwpjeia>i}ieglmja. Let's assume that this ciphertext is exfiltrated in a C2 communication. Now, to ...