Procedure examples

Metamorfo has encrypted payloads and strings.

Embargo has encrypted both MDeployer and MS4 Killer payloads with RC4.

PipeMon modules are stored encrypted on disk.

MagicRAT stores base64 encoded command and contorl URLs in a configuraiton file, with each URL prefixed with the value `LR02DPt22R`.

TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.

KONNI is heavily obfuscated and includes encrypted configuration files.

Winnti for Linux can encode its configuration file with single-byte XOR encoding.

RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.

Many strings in JHUHUGIT are obfuscated with a XOR algorithm.

BLUELIGHT has a XOR-encoded payload.

KGH_SPY has used encrypted strings in its installer.

Micropsia obfuscates the configuration with a custom Base64 and XOR.

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.

RedLine Stealer has encrypted and encoded configuration data with Base64 and XOR functions.

StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.

Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.

Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.

BlackByte Ransomware is distributed as an encrypted payload.

PHPsert can use multiple obfuscation techniques including XOR encoding, hexadecimal character representation, string concatenation, and randomized variable names.

StrelaStealer uses XOR-encoded strings to obfuscate items.

The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.

Sakula uses single-byte XOR obfuscation to obfuscate many of its files.

ZxxZ has been encoded to avoid detection from static analysis tools.

Caminho can use code flattening for payload obfuscation.

Shark can use encrypted and encoded files for C2 configuration.

Bazar has used XOR, RSA2, and RC4 encrypted files.

XLoader features encrypted functions using the RC4 algorithm and bytecode operations.

HiddenFace has encrypted its payload with AES.

CorKLOG has encrypted collected contents using RC4. CorKLOG has also utilized XOR encrypted strings.

Kapeka utilizes AES-256 (CBC mode), XOR, and RSA-2048 encryption schemas for various configuration and other objects.

SpeakUp encodes its second-stage payload with Base64.

LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.

HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.

REvil has used encrypted strings and configuration files.

Milan can encode files containing information about the targeted system.

Most strings in USBStealer are encrypted using 3DES and XOR and reversed.

OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.

Taidoor can use encrypted string blocks for obfuscation.

SUPERNOVA contained Base64-encoded strings.

Seasalt obfuscates configuration data.

Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.

IPsec Helper contains an embedded XML configuration file with an encrypted list of command and control servers. These are written to an external configuration file during execution.

Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.

DanBot can Base64 encode its payload.

GoldenSpy's uninstaller has base64-encoded its variables.

The AshTag AshenOrchestrator component payload as been Base64 encoded and embedded with HTML content from the C2 server.

Carberp has used XOR-based encryption to mask C2 server locations within the trojan.

FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.

The ROADSWEEP binary contains RC4 encrypted embedded scripts.

MOPSLED can encrypt configuration files with a custom ChaCha20 algorithm.