Procedure examples

Lucifer can decrypt its C2 address upon execution.

GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.

Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.

Chrommme can decrypt its encrypted internal code.

Avaddon has decrypted encrypted strings.

Green Lambert can use multiple custom routines to decrypt strings prior to execution.

ISMInjector uses the certutil command to decode a payload file.

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.

GoldMax has decoded and decrypted the configuration file when executed.

CostaBricks has the ability to use bytecode to decrypt embedded payloads.

LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.

HyperBro can unpack and decrypt its payload prior to execution.

Pteranodon can decrypt encrypted data strings prior to using them.

DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.

ROKRAT can decrypt strings using the victim's hostname as the key.

SplatDropper has decoded XOR encrypted payload.

Babuk has the ability to unpack itself into memory using XOR.

Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.

DarkWatchman has the ability to self-extract as a RAR archive.

Dyre decrypts resources needed for targeting the victim.

LunarLoader can deobfuscate files containing the next stages in the infection chain.

BBSRAT uses Expand to decompress a CAB file into executable content.

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer. PlugX has also decrypted its payloads in memory.

Bisonal has decoded strings in the malware using XOR and RC4.

NOOPLDR can decrypt its payload prior to execution.

Lumma Stealer has used Base64-encoded content during execution, decoded via PowerShell.

LightNeuron has used AES and XOR to decrypt configuration files and commands.

KEYPLUG can decode its configuration file to determine C2 protocols.

Clambling can deobfuscate its payload prior to execution.

PureCrypter can decrypt downloaded resources and parse internal files to determine its settings.

DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc() to decode and then execute.

Mongall has the ability to decrypt its payload prior to execution.

The LockBit 3.0 payload is decrypted at runtime.

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.

Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.

TSCookie has the ability to decrypt, load, and execute a DLL and its resources.

Latrodectus has the ability to deobfuscate encrypted strings.

Saint Bot can deobfuscate strings and files for execution.

Chaes has decrypted an AES encrypted binary file to trigger the download of other files.

CharmPower can decrypt downloaded modules prior to execution.

MuddyViper has decrypted the embedded HackBrowserData tool prior to execution.

One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.

Fooder has decrypted payloads using the WinCrypt API and the AES key.

Mori can resolve networking APIs from strings that are ADD-encrypted.

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.

Sagerunex uses a custom decryption routine to unpack itself during installation.

LP-Notes has decrypted strings with lengths ranging from 15 to 19 characters using the same decryption key for each string.