Procedure examples

HTTPTroy has utilized dynamic API resolution by reconstructing API calls during runtime using combinations of arithmetic and logical operations to complicate static analysis.

CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.

Pteranodon can use a dynamic Windows hashing algorithm to map API components.

SplatDropper has leveraged hashed Windows API calls using a seed value of "131313".

PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

Latrodectus can resolve Windows APIs dynamically by hash.

LODEINFO can use a hashing algorithm to dynamically resolve API function addresses.

LP-Notes has dynamically resolved API functions during the C runtime startup.

Bazar can hash then resolve API calls at runtime.

HiddenFace can dynamically resolve Windows APIs.

Samurai can encrypt API name strings with an XOR-based algorithm.

Raccoon Stealer dynamically links key WinApi functions during execution.

Brute Ratel C4 can call and dynamically resolve hashed APIs.

macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.

Cuckoo Stealer is a stripped binary payload.

Pikabot further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector. Other Pikabot variants include encrypted, chunked sections of the stage 2 payload in the initial loader .text section before decrypting and assembling these during execution.

macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.

Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.

BADHATCH has an embedded second stage DLL payload within the first stage of the malware.

DUSTPAN decrypts and executes an embedded payload.

Moneybird contains a configuration blob embedded in the malware itself.

IcedID has embedded malicious functionality in a legitimate DLL file.

CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.

MultiLayer Wiper contains two binaries in its resources section, MultiList and MultiWip. MultiLayer Wiper drops and executes each of these items when run, then deletes them after execution.

Netwalker's DLL has been embedded within the PowerShell script in hex format.

The SMOKEDHAM source code is embedded in the dropper as an encrypted string.

The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.

The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.

DEADWOOD contains an embedded, AES-encrypted payload labeled METADATA that provides configuration information for follow-on execution.

Dtrack has used a dropper that embeds an encrypted payload as extra data.

Invoke-PSImage can be used to embed payload data within a new image file.

CanisterWorm has used embedded second stage Base64-encoded payloads.

IronWind has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.

Ursnif droppers execute base64 encoded PowerShell commands.

Tsundere Botnet’s MSI installer has Base64-encoded command execution.

Zeus Panda obfuscates the macro commands in its initial payload.

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.

CARROTBAT has the ability to execute obfuscated commands on the infected host.

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts.

BADHATCH malicious PowerShell commands can be encoded with base64.

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.

FruitFly executes and stores obfuscated Perl scripts.

DarkWatchman has used Base64 to encode PowerShell commands.

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.

QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.

RedLine Stealer has obfuscated scripts within text files used in execution.