Caesar Cipher

Created the Monday 18 March 2019. Updated 6 months, 2 weeks ago.

The Caesar Cipher is a simple encoding algorithm that was used during the Roman Empire to hide secret messages. In this algorithm, each letter of the plaintext is replaced with a letter that is a fixed number of positions down the alphabet. For example, if the shift value is 3, then the letter "A" would be replaced with "D", "B" would be replaced with "E", and so on.

The Caesar Cipher is a monoalphabetic substitution cipher, meaning that each letter of the plaintext is replaced with the same letter of the ciphertext every time it appears. This makes the Caesar Cipher relatively easy to break, as frequency analysis can be used to determine the shift value and decrypt the ciphertext.

The Caesar Cipher algorithm can be used by malware in several ways. One possible use case is to encode the payload or command and control (C2) communication in order to make it more difficult for security tools and forensic investigators to detect and analyze.

Another possible use case is to use the Caesar Cipher as part of a more complex encoding scheme, such as using it to encrypt the payload and then using another algorithm, such as Base64, to encode the resulting ciphertext. This can make the encoded payload even more difficult to detect and analyze. In both cases, the use of the Caesar Cipher can help the malware avoid detection and continue operating on a compromised system.

Technique Identifier

U0705

Technique Tags

Caesar Cipher Encoding algorithm Roman Empire Secret message Monoalphabetic substitution cipher Plaintext Ciphertext Shift value Frequency analysis

Code Snippets

package main

import (
    "fmt"
    "os"
)

func cipher(text string, direction int) string {

        shift, offset := rune(3), rune(26)
	runes := []rune(text)

        for index, char := range runes {
		switch direction {
		case -1: // encoding
			if char >= 'a'+shift && char <= 'z' ||
				char >= 'A'+shift && char <= 'Z' {
				char = char - shift
			} else if char >= 'a' && char < 'a'+shift ||
				char >= 'A' && char < 'A'+shift {
				char = char - shift + offset
			}
		case +1: // decoding
			if char >= 'a' && char <= 'z'-shift ||
				char >= 'A' && char <= 'Z'-shift {
				char = char + shift
			} else if char > 'z'-shift && char <= 'z' ||
				char > 'Z'-shift && char <= 'Z' {
				char = char + shift - offset
			}
		}
		runes[index] = char
	}
	return string(runes)
}

func encode(text string) string { return cipher(text, -1) }
func decode(text string) string { return cipher(text, +1) }

func main() {
	sec := os.Args[1]
        fmt.Println("[+] Clear text: " + sec)
	encoded := encode(sec)
	fmt.Println("[+] Encoded: " + encoded)
	decoded := decode(encoded)
	fmt.Println("[+] Decoded: " + decoded)
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://blog.malwarebytes.com/threat-analysis/2013/03/obfuscation-malwares-best-friend/