Procedure examples

PolyglotDuke can custom encrypt strings.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

Snip3 has the ability to obfuscate strings using XOR encryption.

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.

Diavol has Base64 encoded the RSA public key used for encrypting files.

Siloscape itself is obfuscated and uses obfuscated API calls.

RustyWater has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.

HTTPTroy has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions to hinder analysis and detection.

Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.

CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.

DRATzarus can be partly encrypted with XOR.

SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.

Avaddon has used encrypted strings.

Conficker has obfuscated its code to prevent its removal from host machines.

Flagpro has been delivered within ZIP or RAR password-protected archived files.

Green Lambert has encrypted strings.

ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.

PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.

POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.

MiniDuke can use control flow flattening to obscure code.

Anchor has obfuscated code with stack strings and string encryption.

DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.

ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

CORESHELL obfuscates strings using a custom stream cipher.

PlugX can use API hashing and modify the names of strings to evade detection.

NOOPLDR can use control flow flattening to help hide malicious code.

Lumma Stealer has used SmartAssembly to obfuscate .NET payloads.

The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.

Epic heavily obfuscates its code to make analysis more difficult.

Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.

The Clambling executable has been obfuscated when dropped on a compromised host.

DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.

SVCReady can encrypt victim data with an RC4 cipher.

Carbanak encrypts strings to make analysis more difficult.

A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.

Hydraq uses basic obfuscation in the form of spaghetti code.

Saint Bot has been obfuscated to help avoid detection.

LODEINFO has used control flow flattening to obfuscate code.

Bundlore has obfuscated data with base64, AES, RC4, and bz2.

Fooder has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.

Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.

Shamoon contains base64-encoded strings.

BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`.

OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.

StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.