Procedure examples

Daserf uses custom base64 encoding to obfuscate HTTP traffic.

Solar can Base64-encode and gzip compress C2 communications including command outputs.

Responses from the Pisloader C2 server are base32-encoded.

Ramsay has used base64 to encode its C2 traffic.

Revenge RAT uses Base64 to encode information sent to the C2 server.

More_eggs has used basE91 encoding, along with encryption, for C2 communication.

SysUpdate has used Base64 to encode its C2 traffic.

Mango can receive Base64-encoded commands from C2.

WIREFIRE can Base64 encode process output sent to C2.

Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.

GrimAgent can base64 encode C2 replies.

STEADYPULSE can transmit URL encoded data over C2.

SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.

BabyShark has encoded data using certutil before exfiltration.

CreepySnail can use Base64 to encode its C2 traffic.

Troll Stealer performs XOR encryption and Base64 encoding of data prior to sending to command and control infrastructure.

Ebury has encoded C2 traffic in hexadecimal format.

njRAT uses Base64 encoding for C2 traffic.

ChChes can encode C2 data with a custom technique that utilizes Base64.

Manjusaka communication includes a client-created session cookie with base64-encoded information representing information from the victim system.

SideTwist has used Base64 for encoded C2 traffic.

MechaFlounder has the ability to use base16 encoded strings in C2.

Mis-Type uses Base64 encoding for C2 traffic.

LunarWeb can use Base64 encoding to obfuscate C2 commands.

Dipsind encodes C2 traffic with base64.

Octopus has encoded C2 communications in Base64.

STARWHALE has the ability to hex-encode collected data from an infected host.

Kevin can Base32 encode chunks of output files during exfiltration.

POWERSTATS encoded C2 traffic with base64.

BADNEWS encodes C2 traffic with base64.

Astaroth encodes data using Base64 before sending it to the C2 server.

QakBot can Base64 encode system information sent to C2.

For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.

Denis encodes the data sent to the server in Base64.

AutoIt backdoor has sent a C2 response that was base64-encoded.

UPPERCUT can base64 encode C2 communications.

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.

Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.

Remcos can serialize collected data with Protobuf.

Mini Shai-Hulud has used base64 encoding to obfuscate URLs used for C2.

Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.

Bankshot encodes commands from the control server using a range of characters and gzip.

TONESHELL has encoded a payload with a random 32-byte key using XOR. TONESHELL has also encoded payloads with a 256-byte key using XOR.

OceanSalt can encode data with a NOT operation before sending the data to the control server.

InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.

RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.

HTTPTroy has obfuscated HTTP POST request communications utilizing XOR with a designated key of 0x56, followed by Base64 encoding.

CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.

Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.

NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.