Implementing custom encoding techniques
Since hashes and encryption algorithms such as Caesar, Base64, and MurmurHash are well-known to security researchers, they can sometimes serve as indicators of the malicious activity of your virus and attract unnecessary attention from information security solutions. But what about custom encryption or encoding methods?
Practical example
Let’s look at another example. Here, we’ll create a Windows reverse shell by encoding the cmd.exe string. For encoding, I will use the Base58 algorithm: https://github.com/PacktPublishing/Malware-Development-for-Ethical-Hackers/blob/main/chapter12/03-custom-encoding/hack.c.
The logic is simple: this C program is designed to decode the cmd.exe string via the Base58 algorithm and spawn a Windows reverse shell.
As you can see, the base58decode() function consists of decoding logic:
int base58decode(
unsigned char const* input, int len, unsigned char *result) {
...
