Payload encryption is a technique attackers use to hide malicious code inside a file or program. By using different encryption methods, the payload's content stays unreadable to traditional detection mechanisms such as antivirus or static analysis systems
Pros and Cons
Pros
- Evading signature-based detection: Encrypting the payload changes its binary structure, making it harder for antivirus engines that rely on signatures to recognise the malware pattern
- Hiding the malicious code: Encryption prevents static analysis tools from reading or interpreting the code without decrypting it first
Cons
- No guarantee of full evasion: Although it can evade signature detection, it is still exposed to more advanced techniques such as heuristic analysis, dynamic (runtime) analysis or sandboxing
- High entropy: The more encryption is applied, the higher the file's entropy. Entropy that is too high can be a signal for some security solutions, which flag it as suspicious or potentially malicious
Types