Procedure examples

Stuxnet calls LoadLibrary then executes exports from a DLL.

RotaJakiro uses dynamically linked shared libraries (`.so` files) to execute additional functionality using `dlopen()` and `dlsym()`.

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.

LightSpy's main executable and module `.dylib` binaries are loaded using a combination of `dlopen()` to load the library, `_objc_getClass()` to retrieve the class definition, and `_objec_msgSend()` to invoke/execute the specified method in the loaded class.

PUNCHBUGGY can load a DLL using the LoadLibrary API.

DarkWatchman can load DLLs.

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.

Metamorfo had used AutoIt to load and execute the DLL payload.

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.

gh0st RAT can load DLLs into memory.

Attor's dispatcher can execute additional plugins by loading the respective DLLs.

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (`.dylib` file) using `dlopen()` and obtains a function pointer to execute within that shared library using `dlsym()`.

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.

Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.

KillDisk loads and executes functions from a DLL.

Astaroth uses the LoadLibraryExW() function to load additional modules.

Dtrack contains a function that calls LoadLibrary and GetProcAddress.

Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.

Ursnif has used encoded data in HTTP URLs for C2.

LAMEHUG can encode queries sent to LLMs.

After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

H1N1 obfuscates C2 traffic with an altered version of base64.

evilginx2 can randomly generate and Base64 encode parameters in phishing links to defeat static detection.

Mythic provides various transform functions to encode and/or randomize C2 data.

TrickBot can Base64-encode C2 commands.

BLINDINGCAN has encoded its C2 traffic with Base64.

Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.

Spark has encoded communications with the C2 server with base64.

Bumblebee has the ability to base64 encode C2 server responses.

BRICKSTORM has leveraged Base64 to encode C2 communications.

Torisma has encoded C2 communications with Base64.

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.

RotaJakiro uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network communication packet.

POWRUNER can use base64 encoded C2 communications.

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.

Misdat network traffic is Base64-encoded plaintext.

TAMECAT has encoded C2 traffic with Base64.

Some Felismus samples use a custom method for C2 traffic that utilizes Base64.

xCaon has used Base64 to encode its C2 traffic.

Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.

Machete has used base64 encoding.

Prikormka encodes C2 traffic with Base64.

Gootloader can retrieve a Base64 encoded stager from C2.

PingPull can encode C2 traffic with Base64.

WellMess has used Base64 encoding to uniquely identify communication to and from the C2.

Mafalda can encode data using Base64 prior to exfiltration.