Procedure examples

BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.

NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.

SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

SodaMaster can use "stackstrings" for obfuscation.

StrelaStealer has been distributed in ISO archives. StrelaStealer has been delivered in encrypted, password-protected ZIP archives.

Drovorub has used XOR encrypted payloads in WebSocket client to server messages.

Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.

Ryuk can use anti-disassembly and code transformation obfuscation techniques.

Final1stspy obfuscates strings with base64 encoding.

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.

Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.

SUNBURST obfuscated collected system information using a FNV-1a + XOR algorithm.

Valak has the ability to base64 encode and XOR encrypt strings.

Samurai can encrypt the names of requested APIs.

PoisonIvy hides any strings related to its own indicators of compromise.

NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.

TajMahal has used an encrypted Virtual File System to store plugins.

Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.

Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.

Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.

Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.

Pillowmint has obfuscated the AES key used for encryption.

SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe</code> process.

ANELLDR code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).

BoomBox can encrypt data using AES prior to exfiltration.

PUNCHTRACK is loaded and executed by a highly obfuscated launcher.

InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.

GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.

Lokibot has obfuscated strings with base64 encoding.

PoetRAT has used a custom encryption scheme for communication between scripts.

CoinTicker initially downloads a hidden encoded file.

Ebury has obfuscated its strings with a simple XOR encryption with a static key.

Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.

ComRAT has encrypted its virtual file system using AES-256 in XTS mode.

PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.

Shai-Hulud has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account. Shai-Hulud has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.

A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.

HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.

KillDisk uses VMProtect to make reverse engineering the malware more difficult.

AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.

SoreFang has the ability to encode and RC6 encrypt data sent to C2.

Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.

ECCENTRICBANDWAGON has encrypted strings with RC4.

ShadowPad has encrypted its payload, a virtual file system, and various files.

QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.

Hancitor has used Base64 to encode malicious links.

jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.

Dridex's strings are obfuscated using RC4.