Procedure examples

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

CORESHELL obfuscates strings using a custom stream cipher.

PlugX can use API hashing and modify the names of strings to evade detection.

NOOPLDR can use control flow flattening to help hide malicious code.

Lumma Stealer has used SmartAssembly to obfuscate .NET payloads.

The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.

Epic heavily obfuscates its code to make analysis more difficult.

Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.

The Clambling executable has been obfuscated when dropped on a compromised host.

DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.

SVCReady can encrypt victim data with an RC4 cipher.

Carbanak encrypts strings to make analysis more difficult.

A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.

Hydraq uses basic obfuscation in the form of spaghetti code.

Saint Bot has been obfuscated to help avoid detection.

LODEINFO has used control flow flattening to obfuscate code.

Bundlore has obfuscated data with base64, AES, RC4, and bz2.

Fooder has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.

Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.

Shamoon contains base64-encoded strings.

BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`.

OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.

StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.

BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.

NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.

SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

SodaMaster can use "stackstrings" for obfuscation.

StrelaStealer has been distributed in ISO archives. StrelaStealer has been delivered in encrypted, password-protected ZIP archives.

Drovorub has used XOR encrypted payloads in WebSocket client to server messages.

Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.

Ryuk can use anti-disassembly and code transformation obfuscation techniques.

Final1stspy obfuscates strings with base64 encoding.

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.

Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.

SUNBURST obfuscated collected system information using a FNV-1a + XOR algorithm.

Valak has the ability to base64 encode and XOR encrypt strings.

Samurai can encrypt the names of requested APIs.

PoisonIvy hides any strings related to its own indicators of compromise.

NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.

TajMahal has used an encrypted Virtual File System to store plugins.

Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.

Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.

Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.

Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.

Pillowmint has obfuscated the AES key used for encryption.

SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe</code> process.

ANELLDR code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).

BoomBox can encrypt data using AES prior to exfiltration.

PUNCHTRACK is loaded and executed by a highly obfuscated launcher.