Procedure examples

MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.

Darkhotel has obfuscated code using RC4, XOR, and RSA.

Whitefly has encrypted the payload used for C2.

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.

Metador has encrypted their payloads.

Fox Kitten has base64 encoded payloads to avoid detection.

APT-C-36 has used encoded and obfuscated files, images, and executables.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Transparent Tribe has dropped encoded executables on compromised hosts.

Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.

Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.

APT33 has used base64 to encode payloads.

APT19 used Base64 to obfuscate payloads.

Kimsuky has delivered malicious payloads within Zip archives.

Gamaredon Group has delivered malicious payloads within compressed archives and zip files.

TA2541 has used compressed and char-encoded scripts in operations.

Higaisa used Base64 encoded compressed payloads.

Leviathan has obfuscated code using gzip compression.

Mofang has compressed the ShimRat executable within malicious email attachments.

Molerats has delivered compressed executables within ZIP files to victims.

VOID MANTICORE has compressed their payloads by leveraging zip files.

WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.

Threat Group-3390 malware is compressed with LZNT1 compression.

Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.

APT32 includes garbage code to mislead anti-malware software and researchers.

Gamaredon Group has obfuscated .NET executables by inserting junk code.

FIN7 has used random junk code to obfuscate malware code.

Mustang Panda has used junk code within their DLL files to hinder analysis.

APT-C-36 has used junk characters to obfuscate malicious scripts.

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.

APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.

APT28 has split archived exfiltration files into chunks smaller than 1MB.

Play has split victims' files into chunks for exfiltration.

Threat Group-3390 actors have split RAR files for exfiltration into parts.

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.

GALLIUM used whoami and query user to obtain information about the victim user.

An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”

Kimsuky has gathered the identity of the user by querying `System.Security.Principal` namespace using the `GetCurrent()` method.

Volt Typhoon has used public tools and executed the PowerShell command `Get-EventLog security -instanceid 4624` to identify associated user and computer account names.

Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.

APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.

Dragonfly used the command query user on victim hosts.

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.

HAFNIUM has used `whoami` to gather user information.

MuddyWater has used malware that can collect the victim’s username.

A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.