decrypting-embedded-configuration
starsforks
How to install decrypting-embedded-configuration?
meltedinhex/analyst-ai-pack/decrypting-embedded-configuration
$npx -y skills add meltedinhex/analyst-ai-pack --skill decrypting-embedded-configurationDecrypts statically embedded malware configuration blobs by trying common schemes
SKILL.md
| 1 | # Decrypting Embedded Configuration |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have an extracted config blob (from a resource, `.data` section, or overlay) that is XOR/RC4/ |
| 6 | base64-obfuscated and want to recover plaintext settings. |
| 7 | - You need a quick brute-force over common schemes before writing a family-specific decryptor. |
| 8 | |
| 9 | **Do not use** this on a live-decrypted-in-memory config — for that use the memory config skill. |
| 10 | This works statically on the extracted blob and executes nothing. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - The extracted ciphertext blob and (optionally) a candidate key. |
| 15 | |
| 16 | ## Safety & Handling |
| 17 | |
| 18 | - Treat decoded endpoints as live C2; defang before sharing. |
| 19 | |
| 20 | ## Workflow |
| 21 | |
| 22 | ### Step 1: Try single-byte XOR |
| 23 | |
| 24 | ```bash |
| 25 | python scripts/analyst.py xor blob.bin |
| 26 | ``` |
| 27 | |
| 28 | Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens |
| 29 | (`http`, `.php`, IP patterns, `id=`). |
| 30 | |
| 31 | ### Step 2: Try RC4 / multi-byte XOR with a key |
| 32 | |
| 33 | ```bash |
| 34 | python scripts/analyst.py rc4 blob.bin --key mysecret |
| 35 | python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33 |
| 36 | ``` |
| 37 | |
| 38 | ### Step 3: Peel base64 / repeat |
| 39 | |
| 40 | If output is base64, decode and re-run the scheme search on the result. |
| 41 | |
| 42 | ### Step 4: Extract and defang |
| 43 | |
| 44 | Pull URLs/IPs/keys from the best-scoring plaintext and defang. |
| 45 | |
| 46 | ## Validation |
| 47 | |
| 48 | - The chosen scheme yields a high printable ratio and real config tokens. |
| 49 | - Recovered endpoints parse as valid hosts/URLs. |
| 50 | - Output is defanged before sharing. |
| 51 | |
| 52 | ## Pitfalls |
| 53 | |
| 54 | - Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables. |
| 55 | - RC4 key drop-bytes variants (RC4-drop) needed by some families. |
| 56 | - Nested layers (base64 over XOR over RC4) requiring multiple passes. |
| 57 | |
| 58 | ## References |
| 59 | |
| 60 | - See [`references/api-reference.md`](references/api-reference.md) for the decryptor. |
| 61 | - ATT&CK T1140 and the RC4 description (linked in frontmatter). |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
