Server-controlled decryption is an unpacking technique where malware cannot reveal its real payload until it talks to an attacker-controlled server. The sample may arrive in a heavily obscured form, but the final decryption key, code fragment, or configuration is delivered only after a live network exchange.
This matters because it frustrates static analysis. Defenders who inspect the file offline may see only a wrapper or harmless-looking data, while the malicious code stays hidden until execution time. It can also slow signature creation, sandboxing, and hash-based blocking if the payload changes or appears only after server validation.
In real attacks, this method is used to gate access to stealer, loader, or ransomware logic, sometimes based on device checks or session tokens. Defenders look for suspicious outbound requests, unusual unpacking behavior, and failures to decrypt when the server is unavailable, which can reveal the malware’s dependence on live infrastructure.