ShinoBOT -the rat/bot malware simulator-

ShinoBOTCan you detect an APT like me ?

SHINOENCODE

ShinoEncode is an encoding method used in obfuscated strings in ShinoBOT and its C2 communication. The purpose is to make it difficult to be detected by signature.

ONLINE ENCODER/DECODER

HOW TO CONVERT

ENCODE

Let's have an example string 'ABC'.

Convert each character to ascii code (not decimal but HEXADECIMAL)
ABC ➜ 41 42 43
Split the digit.
41 42 43 ➜ 4 1 4 2 4 3
Add 2 to each digit.
4 1 4 2 4 3 ➜ 6 3 6 4 6 5
Pick any word which has the length of each digit.
6 3 6 4 6 5 ➜ thanks for trying this encode means
You can add any symbols, uppercase to make the string more natural.
thanks for trying this encode means ➜Thanks for trying this coding means!!

DECODE

Let's have an example string 'Thanks for trying this coding means!!'.

Replace all symbol, space to delimiter.
Thanks for trying this coding means!! ➜ Thanks|for|trying|this|coding|means|
Calculate the length of each word.
Thanks|for|trying|this|coding|means| ➜ 6|3|6|4|6|5|
Merge two digit.
6|3|6|4|6|5| ➜ 63|64|65
Convert each number to character using the ascii code.
63|64|65 ➜ ABC

PROS AND CONS

PROs

Good method for steganography.
Difficult to create signature (pattern matching to detect it).
Able to use any word to make a realistic sentence. Including HTML or source code, whatever.
No dictionary is needed to decode it, which means a small code to decode it.
You can also encode/decode multibyte characters.
You can use it as fortune telling, put your name and encode it. You will get you destiny (just kidding).

CONs

The size will be 15 times　on average.
e.g. 100 bytes will be 1500 bytes.
Sometimes, infelicitous sentence appears. Those words are selected randomly and automatically collected from a bunch of web sites. Please be forewarned.