Procedure examples

TrickBot decodes the configuration data and modules.

BLINDINGCAN has used AES and XOR to decrypt its DLLs.

The Ninja loader component can decrypt and decompress the payload.

Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm. Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload .text section before consolidating them for further execution. Overall LunarMail is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.

Spark has used a custom XOR algorithm to decrypt the payload.

Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.

BRICKSTORM has decoded its encrypted C2 traffic prior to execution. BRICKSTORM also has the ability to decode its obfuscated payload before execution.

Amadey has decoded antivirus name strings.

Torisma has used XOR and Base64 to decode C2 data.

NOKKI uses a unique, custom de-obfuscation technique.

Stuxnet decrypts resources that are loaded into memory and executed.

IronWind can deobfuscate the next stage payload using Base64 and XOR operations with the key "53".

RotaJakiro uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the `head` and `key` sections in the network packet structure used for C2 communications.

AvosLocker has deobfuscated XOR-encoded strings.

The Chinoxy dropping function can initiate decryption of its config file.

SharpStage has decompressed data received from the C2 server.

COATHANGER decodes configuration items from a bundled file for command and control activity.

Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.

Smoke Loader deobfuscates its code.

WindTail has the ability to decrypt strings using hard-coded AES keys.

Exaramel for Linux can decrypt its configuration file.

PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.

HeartCrypt can decrypt payloads prior to execution.

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.

CASTLETAP can filter and deobfuscate an XOR encrypted activation string in the payload of an ICMP echo request.

ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.

RansomHub can use a provided passphrase to decrypt its configuration file.

Tsundere Botnet’s loader has decrypted obfuscated JavaScript files using the AES-256 CBC algorithm, a build-specific key, and initialization vector.

Zeus Panda decrypts strings in the code during the execution process.

InvisibleFerret has decoded XOR-encrypted and Base-64-encoded payloads prior to execution.

Bankshot decodes embedded XOR strings.

xCaon has decoded strings from the C2 server before executing commands.

AuditCred uses XOR and RC4 to perform decryption on the code functions.

ROAMINGHOUSE can decode and drop a malicious ZIP file prior to execution.

TONESHELL has decoded its payload prior to execution.

UPSTYLE encodes its main content prior to loading via Python as base64-encoded blobs.

Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.

RainyDay can decrypt its payload via a XOR key.

Ecipekac has the ability to decrypt fileless loader modules.

AppleSeed can decode its payload prior to execution.

BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.

PyDCrypt has decrypted and dropped the DCSrv payload to disk.

PowerExchange can decode and decrypt C2 commands received via email.

BOOKWORM has decoded its Base64 encoded payload prior to execution. BOOKWORM has also encrypted files with RC4 and has decrypted its payload prior to execution.

EnvyScout can deobfuscate and write malicious ISO files to disk.

Aria-body has the ability to decrypt the loader configuration and payload DLL.

Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.

Crimson can decode its encoded PE file prior to execution.

TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.

DUSTTRAP deobfuscates embedded payloads.