Shulfar (Netomize's name) malware encrypts its C&C traffic over the TCP protocol using a custom encryption algorithm and a fixed key. We took this as a challenge to write a detection rule targeting the encrypted message packet by simulating the decryption algorithm for all possible keys.