> Technique · RC4 + XOR Double-Stage Driver Decryption_

~/packetpursuit $ cat /intel/techniques/rc4-xor-double-stage-driver-decryption.md

typetechniquecreated2026-07-03updated2026-07-03defense-evasionobfuscationdriver-loadingrc4xor

RC4 + XOR Double-Stage Driver Decryption

A two-stage decryption routine where an embedded driver image is first decrypted with a hardcoded RC4 key, then passed through an additional XOR pass before being written to disk and loaded into the kernel via NtLoadDriver.

Method

  1. Decode embedded GUID blocks using a word-wise XOR loop with multipliers 0xb529 and 0x9e37.^[r2:fcn.1400095d0]
  2. Decrypt the driver payload in-place using RC4 with key LordROmAn$ (10-byte ASCII).^[strings.txt:453]^[r2:fcn.140005090]
  3. Apply a secondary XOR pass over the RC4 output to produce the final PE image.^[strings.txt:10308]^[r2:fcn.140005090]
  4. Write decrypted image to a constructed drop path and call NtLoadDriver.^[strings.txt:10321]

Detection Notes

  • No entropy spike in .rdata (RC4 output still looks random).
  • Look for LordROmAn$ in memory or on disk — this key is unique to the SilverFox cluster.
  • The 0xb529 / 0x9e37 multiplier constants appear in both GUID decoding and string-decrypt loops.

Capabilities

  • rc4-xor-double-stage-driver-decryption