Procedure examples

APT41 used VMProtected binaries in multiple intrusions.

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments. Additionally, Gamaredon Group has used an obfuscated .drv file.

Gallmaker obfuscated shellcode used during execution.

Sandworm Team has used Base64 encoding within malware variants.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

Rocke has modified UPX headers after packing files to break unpackers.

APT37 obfuscates strings and payloads.

Ke3chang has used Base64-encoded shellcode strings.

RedCurl has used malware with string encryption. RedCurl has also encrypted data and has encoded PowerShell commands using Base64. RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.

BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.

Windshift has used string encoding with floating point calculations.

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.

Earth Lusca used Base64 to encode strings.

BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.

Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.

TrickBot uses non-descriptive names to hide functionality.

EKANS uses encoded strings in its process kill list.

SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.

Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.

BRICKSTORM has utilized Go libraries to include Garble to obfuscate code.

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.

NOKKI uses Base64 encoding for strings.

AvosLocker has used XOR-encoded strings.

COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.

Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.

Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.

NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

BOOKWORM has been delivered using self-extracting RAR archives.

OLDBAIT obfuscates internal strings and unpacks them at startup.

TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

Turian can use VMProtect for obfuscation.

Action RAT's commands, strings, and domains can be Base64 encoded within the payload.

PUBLOAD has obfuscated DLL names using the ror13AddHash32 algorithm.

The Gootloader first stage script is obfuscated using random alpha numeric strings.

PolyglotDuke can custom encrypt strings.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

Snip3 has the ability to obfuscate strings using XOR encryption.

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.

Diavol has Base64 encoded the RSA public key used for encrypting files.

Siloscape itself is obfuscated and uses obfuscated API calls.

RustyWater has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.

HTTPTroy has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions to hinder analysis and detection.