agentsclimarketplace

Decrypting embedded configuration

Skill meltedinhex/analyst-ai-pack/skills/decrypting-embedded-configuration

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill decrypting-embedded-configuration

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 451 tokens by cl100k_base, as published. Nobody here has run it

Decrypting Embedded Configuration

When to Use

  • You have an extracted config blob (from a resource, .data section, or overlay) that is XOR/RC4/ base64-obfuscated and want to recover plaintext settings.
  • You need a quick brute-force over common schemes before writing a family-specific decryptor.

Do not use this on a live-decrypted-in-memory config — for that use the memory config skill. This works statically on the extracted blob and executes nothing.

Prerequisites

  • The extracted ciphertext blob and (optionally) a candidate key.

Safety & Handling

  • Treat decoded endpoints as live C2; defang before sharing.

Workflow

Step 1: Try single-byte XOR

python scripts/analyst.py xor blob.bin

Brute-forces all 256 single-byte keys and scores each output for printable ratio and config tokens (http, .php, IP patterns, id=).

Step 2: Try RC4 / multi-byte XOR with a key

python scripts/analyst.py rc4 blob.bin --key mysecret
python scripts/analyst.py xorkey blob.bin --key 0x11,0x22,0x33

Step 3: Peel base64 / repeat

If output is base64, decode and re-run the scheme search on the result.

Step 4: Extract and defang

Pull URLs/IPs/keys from the best-scoring plaintext and defang.

Validation

  • The chosen scheme yields a high printable ratio and real config tokens.
  • Recovered endpoints parse as valid hosts/URLs.
  • Output is defanged before sharing.

Pitfalls

  • Single-byte XOR coincidentally producing some ASCII — require config tokens, not just printables.
  • RC4 key drop-bytes variants (RC4-drop) needed by some families.
  • Nested layers (base64 over XOR over RC4) requiring multiple passes.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.