Procedure examples

Denis obfuscates its code and encrypts the API names.

Comnie uses RC4 and Base64 to obfuscate strings.

Lizar has obfuscated the fingerprint of the victim system, the local IP address, and the Fowler-Noll-V 1 (FNV-1) hash of the local IP address using an XOR operation. The data is then sent to the C2 server.

H1N1 uses multiple techniques to obfuscate strings, including XOR.

SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.

Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.

Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.

ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.

Sliver obfuscates configuration and other static files using native Go libraries such as `garble` and `gobfuscate` to inhibit configuration analysis and static detection.

CARROTBALL has used a custom base64 alphabet to decode files.

Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths. Remcos can also employ control flow flattening to hinder analysis.

Out1 has the ability to encode data.

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.

MCMD can Base64 encode output strings prior to sending to C2.

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.

HeartCrypt can add several hundred thousand kilobytes of null padding to payloads before saving onto the file system.

TONESHELL has used randomized padding to obfuscate payloads.

Emotet inflates malicious files and malware as an evasion technique.

Snip3 can obfuscate strings using junk Chinese characters.

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.

LightSpy's configuration file is appended to the end of the binary. For example, the last `0x1d0` bytes of one sample is an AES encrypted configuration file with a static key of `3e2717e8b3873b29`.

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.

Javali can use large obfuscated libraries to hinder detection and analysis.

PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.

Bisonal has appended random binary data to the end of itself to generate a large binary.

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.

Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.

Caminho can use junk code for obfuscation.

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

GrimAgent has the ability to add bytes to change the file hash.

Goopy has had null characters padded in its malicious DLL payload.

QakBot can use large file sizes to evade detection.

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.

TrickBot leverages a custom packer to obfuscate its functionality.

BLINDINGCAN has been packed with the UPX packer.

Spark has been packed with Enigma Protector to obfuscate its contents.

Torisma has been packed with Iz4 compression.

yty packs a plugin with UPX.

The first stage of COATHANGER is delivered as a packed file.

Misdat was typically packed using UPX.

HeartCrypt can pack malicious Windows x86 and .NET payloads in order to evade detection.

AppleSeed has used UPX packers for its payload DLL.

NETWIRE has used .NET packer tools to evade detection.

GreyEnergy is packed for obfuscation.

Emotet has used custom packers to protect its payloads.

Tomiris has been packed with UPX.