Malwaremedium
An Introduction to Recognizing and Decoding RC4 Encryption in Malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-1776 | Use-After-Free Memory Corruption RCE in Microsoft Internet Explorer | — | 83% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 70e2090d5dee18f3e45d38bf254eff87 | using a variant of the Coremex Search Engine Hijacker (MD5: 70E2090D5DEE18F3E45D38BF254EFF87) after it has resumed its suspended child process. RC4 is i |
| md5 | ea497f6bd6555ba85127ce083a513be8 | e of my system files. The original hash that it encodes is: EA497F6BD6555BA85127CE083A513BE8: 10002174loop: 10002174movecx,[ebp+68h+state.index1]; ECX = |
From the original article
10 min read at blog.talosintelligence.com
There is something that we come across almost daily when we analyze malware in the VRT: RC4. We recently came across CVE-2014-1776 and like many malware samples and exploits we analyze, RC4 is used to obfuscate or encrypt what it is really doing. There are many ways to implement RC4 and it is a very simple, small algorithm.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.