Procedure examples

LunarLoader has the ability to use Microsoft Outlook add-ins to establish persistence.

Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.

LunarMail has the ability to use Outlook add-ins for persistence.

During SharePoint ToolShell Exploitation, threat actors decrypted scripts prior to execution.

During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.

During RedPenguin, UNC3886 used malware implants to deobfuscate incoming C2 messages and encoded archives.

During Operation Honeybee, malicious files were decoded prior to execution.

During Operation Dust Storm, attackers used VBS code to decode payloads.

For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.

Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.

During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.

During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.

During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.

During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.

During the 2025 Poland Wiper Attacks, the adversaries decoded a Base64-encoded ZIP archive using the built-in certutil.

During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.

APT38 has used the RC4 algorithm to decrypt configuration data.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

Kimsuky has decoded malicious VBScripts using Base64. Kimsuky has also decoded malicious PowerShell scripts using Base64. Kimsuky has decoded RC4 obfuscated files prior to downloading files from their infrastructure.

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

FIN7 has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated block of data with the key `qawsed1q2w3e`, which led to the installation of Lizar.

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.

Rocke has extracted tar.gz files after downloading them from a C2 server.

APT39 has used malware to decrypt encrypted CAB files.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.

TA505 has decrypted packed DLLs with an XOR key.

Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

Darkhotel has decrypted strings and imports using RC4 during execution.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Malteiro has the ability to deobfuscate downloaded files prior to execution.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Earth Lusca has used certutil to decode a string into a cabinet file.

Molerats decompresses ZIP files once on the victim machine.