Decrypting Embedded Configuration

When to Use

• You have an extracted config blob (from a resource, .data section, or overlay) that is XOR/RC4/ base64-obfuscated and want to recover plaintext settings.
• You need a quick brute-force over common schemes before writing a family-specific decryptor.

Do not use this on a live-decrypted-in-memory config — for that use the memory config skill. This works statically on the extracted blob and executes nothing.

Prerequisites

• The extracted ciphertext blob and (optionally) a candidate key.

Safety & Handling

• Treat decoded endpoints as live C2; defang before sharing.

Workflow

Step 1: Try single-byte XOR

python scripts/analyst.py xor blob.bin

Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens (http, .php, IP patterns, id=).

Step 2: Try RC4 / multi-byte XOR with a key

python scripts/analyst.py rc4 blob.bin --key mysecret
python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33

Step 3: Peel base64 / repeat

If output is base64, decode and re-run the scheme search on the result.

Step 4: Extract and defang

Pull URLs/IPs/keys from the best-scoring plaintext and defang.

Validation

• The chosen scheme yields a high printable ratio and real config tokens.
• Recovered endpoints parse as valid hosts/URLs.
• Output is defanged before sharing.

Pitfalls

• Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables.
• RC4 key drop-bytes variants (RC4-drop) needed by some families.
• Nested layers (base64 over XOR over RC4) requiring multiple passes.

References

• See references/api-reference.md for the decryptor.
• ATT&CK T1140 and the RC4 description (linked in frontmatter).