Procedure examples

ZIRCONIUM has used multi-stage packers for exploit code.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

TA2541 has used a .NET packer to obfuscate malicious files.

Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.

The White Company has obfuscated their payloads through packing.

Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.

MoustachedBouncer has used malware plugins packed with Themida.

Storm-0501 has used Themida to pack Cobalt Strike payloads.

TA505 has used UPX to obscure malicious code.

APT29 used UPX to pack files.

Dark Caracal has used UPX to pack Bandook.

Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.

Threat Group-3390 has packed malware and tools, including using VMProtect.

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.

Andariel has hidden malicious executables within PNG files.

APT37 uses steganography to send images to users that are embedded with shellcode.

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.

Leviathan has used steganography to hide stolen data inside other files stored on Github.

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.

TA551 has hidden encoded data for malware DLLs in a PNG.

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

Earth Lusca has used steganography to hide shellcode in a BMP image file.

TeamPCP has hidden malicious payloads in the frame data of WAV audio files.

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).

Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.

GALLIUM ensured each payload had a unique hash, including by using different types of packers.

APT3 has been known to remove indicators of compromise from tools.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

UNC3886 has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.

Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.

Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.

APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.

Kimsuky has leveraged dynamic API resolution using custom hashing techniques.

Mustang Panda has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.

TA577 has used LNK files to execute embedded DLLs.

Lazarus Group has distributed malicious payloads embedded in PNG files.

Moonstone Sleet embedded payloads in trojanized software for follow-on execution.

Kimsuky has encoded malicious PowerShell scripts using Base64.

Patchwork has obfuscated a script with Crypto Obfuscator.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

FIN6 has used encoded PowerShell commands.

Gamaredon Group has used obfuscated or encrypted scripts.

Leafminer obfuscated scripts that were used on victim machines.

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.