SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
decrypting-embedded-configuration
0
Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Decrypting Embedded Configuration ## When to Use - You have an extracted config blob (from a resource, `.data` section, or overlay) that is XOR/RC4/ base64-obfuscated and want to recover plaintext settings. - You need a quick brute-force over common schemes before writing a family-specific decryptor. **Do not use** this on a live-decrypted-in-memory config — for that use the memory config skill. This works statically on the extracted blob and executes nothing. ## Prerequisites - The extracted ciphertext blob and (optionally) a candidate key. ## Safety & Handling - Treat decoded endpoints as live C2; defang before sharing. ## Workflow ### Step 1: Try single-byte XOR ```bash python scripts/analyst.py xor blob.bin ``` Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens (`http`, `.php`, IP patterns, `id=`). ### Step 2: Try RC4 / multi-byte XOR with a key ```bash python scripts/analyst.py rc4 blob.bin --key mysecret python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33 ``` ### Step 3: Peel base64 / repeat If output is base64, decode and re-run the scheme search on the result. ### Step 4: Extract and defang Pull URLs/IPs/keys from the best-scoring plaintext and defang. ## Validation - The chosen scheme yields a high printable ratio and real config tokens. - Recovered endpoints parse as valid hosts/URLs. - Output is defanged before sharing. ## Pitfalls - Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables. - RC4 key drop-bytes variants (RC4-drop) needed by some families. - Nested layers (base64 over XOR over RC4) requiring multiple passes. ## References - See [`references/api-reference.md`](references/api-reference.md) for the decryptor. - ATT&CK T1140 and the RC4 description (linked in frontmatter).