Procedure examples

InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.

GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.

Lokibot has obfuscated strings with base64 encoding.

PoetRAT has used a custom encryption scheme for communication between scripts.

CoinTicker initially downloads a hidden encoded file.

Ebury has obfuscated its strings with a simple XOR encryption with a static key.

Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.

ComRAT has encrypted its virtual file system using AES-256 in XTS mode.

PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.

Shai-Hulud has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account. Shai-Hulud has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.

A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.

HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.

KillDisk uses VMProtect to make reverse engineering the malware more difficult.

AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.

SoreFang has the ability to encode and RC6 encrypt data sent to C2.

Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.

ECCENTRICBANDWAGON has encrypted strings with RC4.

ShadowPad has encrypted its payload, a virtual file system, and various files.

QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.

Hancitor has used Base64 to encode malicious links.

jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.

Dridex's strings are obfuscated using RC4.

Denis obfuscates its code and encrypts the API names.

Comnie uses RC4 and Base64 to obfuscate strings.

Lizar has obfuscated the fingerprint of the victim system, the local IP address, and the Fowler-Noll-V 1 (FNV-1) hash of the local IP address using an XOR operation. The data is then sent to the C2 server.

H1N1 uses multiple techniques to obfuscate strings, including XOR.

SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.

Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.

Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.

ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.

Sliver obfuscates configuration and other static files using native Go libraries such as `garble` and `gobfuscate` to inhibit configuration analysis and static detection.

CARROTBALL has used a custom base64 alphabet to decode files.

Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths. Remcos can also employ control flow flattening to hinder analysis.

Out1 has the ability to encode data.

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.

MCMD can Base64 encode output strings prior to sending to C2.