Procedure examples

Rifdoor has encrypted strings with a single byte XOR algorithm.

Cuckoo Stealer strings are XOR-encrypted.

The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.

A Volgmer variant is encoded using a simple XOR cipher.

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.

ZeroT has encrypted its payload with RC4.

Skidmap has encrypted it's main payload using 3DES.

SamSam has been seen using AES or DES to encrypt payloads and payload components.

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.

Mispadu also uses encoded configuration files and has encoded payloads using Base64.

Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.

RustyWater has encrypted all strings in the code using position independent XOR encryption.

Fysbis has been encrypted using XOR and RC4.

IcedID has utilzed encrypted binaries and base64 encoded strings.

VERMIN is obfuscated using the obfuscation tool called ConfuserEx.

DCSrv's configuration is encrypted.

BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.

Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.

Chrommme can encrypt sections of its code to evade detection.

SocGholish has single or double Base-64 encoded references to its second-stage server URLs.

Hi-Zor uses various XOR techniques to obfuscate its components.

LightSpy encrypts the C2 configuration file using AES with a static key, while the module `.dylib` files use a rolling one-byte encoding for obfuscation.

GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.

In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.

HyperBro can be delivered encrypted to a compromised host.

BeaverTail has obfuscated strings of code with Base64 encoding within the JavaScript version of the malware. BeaverTail has also utilized the open-source tool JavaScript-Obfuscator to obfuscate strings and functions.

SplatDropper has also utilized XOR encrypted payload.

PlugX has leveraged XOR encryption with the key of 123456789.

Reaver encrypts some of its files with XOR.

Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.

The NOOPLDR payload is encrypted with AES256-CBC.

Lumma Stealer has used AES-encrypted payloads contained within PowerShell scripts.

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.

LightNeuron encrypts its configuration files with AES-256.

KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.

PureCrypter has used SmartAssembly and NET-Reactor for string encryption and control flow obfuscation.

DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation. DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.

NanHaiShu encodes files in Base64.

The LockBit 3.0 payload includes an encrypted main component.

FoggyWeb has been XOR-encoded.

Some strings in HOMEFRY are obfuscated with XOR x56.

Elise encrypts several of its files, including configuration files.

Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.

Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.

The LODEINFO loader module contains XOR-encrypted shellcode.

APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.

Sagerunex can be passed a reference to an XOR-encrypted configuration file at runtime.

LP-Notes has used a custom addition-based function and a string stacking function for string encryption.

BendyBear has encrypted payloads using RC4 and XOR.

GlassWorm has leveraged AES-256-CBC encryption to obfuscate its malicious JavaScript payload. GlassWorm has also utilized Base64 encoding to obfuscate the C2 details stored in the Solana memo field.

Uroburos can use AES and CAST-128 encryption to obfuscate resources.