Procedure examples

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.

THINCRUST can deobfuscate RSA encrypted C2 commands received through the DEVICEID cookie.

Machete’s downloaded data is decrypted using AES.

PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.

Action RAT can use Base64 to decode actor-controlled C2 server communications.

Avenger has the ability to decrypt files downloaded from C2.

DUSTPAN decodes and decrypts embedded payloads.

PUBLOAD has decoded its payload prior to execution.

SystemBC has the ability to decrypt RC4 encrypted packets and to decode obfuscated data before C2 communication. Additionally, SystemBC has decrypted its config file that was encoded with XOR and a hardcoded 40-byte key.

Gootloader has the ability to decode and decrypt malicious payloads prior to execution.

PingPull can decrypt received data from its C2 server by using AES.

WellMess can decode and decrypt data received from C2.

DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.

Woody RAT can deobfuscate Base64-encoded strings and scripts.

Mafalda can decrypt files and data.

Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.

PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.

HexEval Loader has decoded its payload prior to execution.

Hildegard has decrypted ELF files with AES.

SombRAT can run upload to decrypt and upload files from storage.

ODAgent can Base64-decode and XOR decrypt received C2 commands.

Snip3 can decode its second-stage PowerShell script prior to execution.

FYAnti has the ability to decrypt an embedded .NET module.

Cuckoo Stealer strings are deobfuscated prior to execution.

WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.

RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.

CLAIMLOADER has decoded its payload prior to execution.

P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.

Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.

Volgmer deobfuscates its strings and APIs once its executed.

WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.

ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.

RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.

Skidmap has the ability to download, unpack, and decrypt tar.gz files .

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.

Line Dancer shellcode payloads are base64 encoded when transmitted to compromised devices.

Conti has decrypted its payload using a hardcoded AES-256 key.

Raspberry Robin contains several layers of obfuscation to hide malicious code from detection and analysis.

Mispadu decrypts its encrypted configuration files prior to execution.

The REPTILE launcher component can decrypt kernel module code from a file and load it into memory.

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.

Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.

RustyWater has used the WriteHexToFile function to transform an embedded hex string to the payload CertificationKit.ini.

VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.

Nightdoor stores network configuration data in a file XOR encoded with the key value of `0x7A`.

HTTPTroy has decoded strings encoded with Base64 and XOR prior to execution.

HUI Loader can decrypt and load files containing malicious payloads.

CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.

FatDuke can decrypt AES encrypted C2 communications.