Re-encryption is the process of wrapping a file, payload, or data stream in a new encrypted or obscured form so it looks different from the previous version. In malware delivery, this is often used as a concealment step rather than a true security measure: the underlying malicious code may stay the same, but its outer appearance changes.
It matters because many defenders still rely on static indicators such as hashes, signatures, and file patterns. If an attacker repeatedly re-encrypts or repacks the payload, those indicators become less useful and security tools must work harder to identify the threat. Re-encryption is commonly seen in crypters, droppers, and packers that try to evade antivirus scanning and sandbox inspection.
Defenders respond by looking beyond the file’s surface: process behavior, suspicious unpacking activity, child processes, archive handling, and email telemetry. In practice, re-encryption is part of the broader obfuscation playbook used to buy time against detection.