Procedure examples

QUADAGENT encodes C2 communications with base64.

KONNI has used a custom base64 key to encode stolen data before exfiltration.

gh0st RAT has used Zlib to compress C2 communications data before encrypting it.

DnsSystem can Base64 encode data sent to C2.

A JHUHUGIT variant encodes C2 POST data base64.

down_new has the ability to base64 encode C2 communications.

Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.

RedLine Stealer has used Base64 to encode command and control traffic.

OopsIE encodes data in hexadecimal format over the C2 channel.

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

QUIETCANARY can base64 encode C2 communications.

PHPsert can use Base64-encoded values in C2 communications.

StrelaStealer utilizes a hard-coded XOR key to encrypt the content of HTTP POST requests to command and control infrastructure.

PULSECHECK can base-64 encode encrypted data sent through C2.

Kapeka utilizes JSON objects to send and receive information from command and control nodes.

Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

SpeakUp encodes C&C communication using Base64.

WARPWIRE can Base64 encode captured credentials with `btoa()` prior to sending to C2.

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.

SUNBURST used Base64 encoding in its C2 traffic.

Cobian RAT obfuscates communications with the C2 server using Base64 encoding.

Valak has returned C2 data as encoded ASCII.

Samurai can base64 encode data sent in C2 communications prior to its encryption.

OSX_OCEANLOTUS.D has used `zlib` to compress all data after 0x52 for the custom TCP C2 protocol.

Daserf uses custom base64 encoding to obfuscate HTTP traffic.

Solar can Base64-encode and gzip compress C2 communications including command outputs.

Responses from the Pisloader C2 server are base32-encoded.

Ramsay has used base64 to encode its C2 traffic.

Revenge RAT uses Base64 to encode information sent to the C2 server.

More_eggs has used basE91 encoding, along with encryption, for C2 communication.

SysUpdate has used Base64 to encode its C2 traffic.

Mango can receive Base64-encoded commands from C2.

WIREFIRE can Base64 encode process output sent to C2.

Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.

GrimAgent can base64 encode C2 replies.

STEADYPULSE can transmit URL encoded data over C2.

SLIGHTPULSE can base64 encode all incoming and outgoing C2 messages.

BabyShark has encoded data using certutil before exfiltration.

CreepySnail can use Base64 to encode its C2 traffic.

Troll Stealer performs XOR encryption and Base64 encoding of data prior to sending to command and control infrastructure.

Ebury has encoded C2 traffic in hexadecimal format.

njRAT uses Base64 encoding for C2 traffic.

ChChes can encode C2 data with a custom technique that utilizes Base64.

Manjusaka communication includes a client-created session cookie with base64-encoded information representing information from the victim system.

SideTwist has used Base64 for encoded C2 traffic.

MechaFlounder has the ability to use base16 encoded strings in C2.

Mis-Type uses Base64 encoding for C2 traffic.

LunarWeb can use Base64 encoding to obfuscate C2 commands.

Dipsind encodes C2 traffic with base64.

Octopus has encoded C2 communications in Base64.