ShinoBOTCan you detect an APT like me ?
SHINOENCODE
ShinoEncode is an encoding method used in obfuscated strings in ShinoBOT and its C2 communication. The purpose is to make it difficult to be detected by signature.
ONLINE ENCODER/DECODER



HOW TO CONVERT
ENCODE
Let's have an example string 'ABC'.
  1. Convert each character to ascii code (not decimal but HEXADECIMAL)
    ABC41 42 43
  2. Split the digit.
    41 42 434 1 4 2 4 3
  3. Add 2 to each digit.
    4 1 4 2 4 36 3 6 4 6 5
  4. Pick any word which has the length of each digit.
    6 3 6 4 6 5 thanks for trying this encode means
  5. You can add any symbols, uppercase to make the string more natural.
    thanks for trying this encode meansThanks for trying this coding means!!
DECODE
Let's have an example string 'Thanks for trying this coding means!!'.
  1. Replace all symbol, space to delimiter.
    Thanks for trying this coding means!!Thanks|for|trying|this|coding|means|
  2. Calculate the length of each word.
    Thanks|for|trying|this|coding|means|6|3|6|4|6|5|
  3. Merge two digit.
    6|3|6|4|6|5|63|64|65
  4. Convert each number to character using the ascii code.
    63|64|65ABC
PROS AND CONS
PROs
CONs