Procedure examples

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

Sidewinder has used base64 encoding for scripts.

Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.

Aquatic Panda has encoded PowerShell commands in Base64.

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

TA505 has used base64 encoded PowerShell commands.

Chimera has encoded PowerShell commands.

Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.

TA551 has used obfuscated variable names in a JavaScript configuration file.

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.

Fox Kitten has base64 encoded scripts to avoid detection.

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.

Silence has used environment variable string substitution for obfuscation.

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

HEXANE has used Base64-encoded scripts.

WIRTE has XOR encrypted command line strings to conceal malware execution chains.

Magic Hound has used base64-encoded commands.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

APT19 used Base64 to obfuscate executed commands.

APT32's backdoor has stored its configuration in a registry key.

Turla has used the Registry to store encrypted and encoded payloads.

Kimsuky has used the LNK icon location to execute malicious scripts. Kimsuky has also padded the LNK target field properties with extra spaces to obscure the script.

Gamaredon Group has used LNK files to hide malicious scripts for execution.

Mustang Panda has utilized LNK files to hide malicious scripts for execution. Mustang Panda has also leveraged LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

Elderwood has encrypted documents and malicious executables.

Kimsuky has obfuscated code within files by converting hexadecimal strings to decimal numbers using the `CLng function` in combination with processing arithmetic operations and leveraging the `Chr function` to generate readable characters. Kimsuky has also encoded files with Base64 and RC4. Kimsuky has utilized XOR and RC4 to encode malicious payloads.

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.

TeamTNT has encrypted its binaries via AES and encoded files using Base64.

APT18 obfuscates strings in the payload.

Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.

APT39 has used malware to drop encrypted CAB files.

Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.

TA2541 has used compressed and char-encoded scripts in operations.

Moses Staff has used obfuscated web shells in their operations.

OilRig has encrypted and encoded data in its malware, including by using base64.

Higaisa used Base64 encoded compressed payloads.

Tropic Trooper has encrypted configuration files.

Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.

Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.

Leviathan has obfuscated code using base64.

Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.

Blue Mockingbird has obfuscated the wallet address in the payload binary.

TA505 has password-protected malicious Word documents.

BITTER has used a RAR SFX dropper to deliver malware.

Mofang has encrypted payloads before they are downloaded to victims.

Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.