Procedure examples

Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

Melcoz has been packed with VMProtect and Themida.

Troll Stealer has been delivered as a VMProtect-packed binary.

Astaroth uses a software packer called Pe123\RPolyCryptor.

QakBot can encrypt and pack malicious payloads.

jRAT payloads have been packed.

Dok is packed with an UPX executable packer.

H1N1 uses a custom packing algorithm.

CSPY Downloader has been packed with UPX.

Donut can generate packed code modules.

PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).

Pikabot loads a set of PNG images stored in the malware's resources section (RCDATA), each with an encrypted section containing portions of the core Pikabot core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.

Avenger can extract backdoor malware from downloaded images.

PolyglotDuke can use steganography to hide C2 information in images.

RegDuke can hide data in images, including use of the Least Significant Bit (LSB).

ProLock can use .jpg and .bmp files to store its payload.

RDAT can also embed data within a BMP image prior to exfiltration.

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.

Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.

Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.

IcedID has embedded binaries within RC4 encrypted .png files.

ObliqueRAT can hide its payload in BMP images hosted on compromised websites.

Bandook has used .PNG images within a zip file to build the executable.

LiteDuke has used image files to hide its loader component.

ABK can extract a malicious Portable Executable (PE) from a photo.

Ramsay has PE data embedded within JPEG files contained within Word documents.

build_downer can extract malware from a downloaded JPEG.

BBK can extract a malicious Portable Executable (PE) from a photo.

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.

DarkWatchman has used the csc.exe tool to compile a C# executable.

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.

Samurai can compile and execute downloaded modules at runtime.

Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.

njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.

Sliver includes functionality to retrieve source code and compile locally prior to execution in victim environments.

The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.

InvisiMole has undergone regular technical improvements in an attempt to evade detection.

Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.

SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.

Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.

Penquin can remove strings from binaries.

QakBot can make small changes to itself in order to change its checksum and hash value.

Waterbear can scramble functions not to be executed again with random values.

PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.

EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.

QakBot has been delivered in ZIP files via HTML smuggling.

AvosLocker has used obfuscated API calls that are retrieved by their checksums.

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.

CANONSTAGER has utilized custom API hashing to obfuscate the Windows APIs being used.

CLAIMLOADER has utilized XOR-encrypted API names and native APIs of `LdrLoadDll()` and `LderGetProcedureAddress()` to resolve imports dynamically.