Procedure examples

Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.

DEADEYE has encrypted its payload.

Mango contains a series of base64 encoded substrings.

Kessel's configuration is hardcoded and RC4 encrypted within the binary.

PHASEJAM has launched a webshell using the `MIME::Base64` module that encoded and decoded Base64 commands.

YAHOYAH encrypts its configuration file using a simple algorithm.

StealBit stores obfuscated DLL file names in its executable.

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.

Penquin has encrypted strings in the binary for obfuscation.

SPAWNCHIMERA has encoded a private key with XOR. SPAWNCHIMERA has also encrypted data to be extracted using AES encryption.

Winnti for Windows has the ability to encrypt and compress its payload.

njRAT has included a base64 encoded executable.

metaMain's module file has been encrypted via XOR.

Heyoka Backdoor can encrypt its payload.

The LunarWeb install files have been encrypted with AES-256.

Older XCSSET variants use `xxd` to encode modules. Later versions pass an `xxd` or `base64` encoded blob through multiple decoding stages to reconstruct the module name, AppleScript, or shell command. For example, the initial network request uses three layers of hex decoding before executing a curl command in a shell.

Qilin can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.

STARWHALE has been obfuscated with hex-encoded strings.

The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.

Kevin has Base64-encoded its configuration file.

DRYHOOK has encrypted stolen credentials strings within a file using both Base64 and RC4 with a hard-coded key.

Remexi obfuscates its configuration data with XOR.

Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.

DOWNIISSA code is base64 encoded and XOR encrypted.

The Helminth config file is encrypted with RC4.

DEADWOOD contains an embedded, AES-encrypted resource named METADATA that contains configuration information for follow-on execution.

Waterbear has used RC4 encrypted shellcode and encrypted functions.

The FIVEHANDS payload is encrypted with AES-128.

LoudMiner has encrypted DMG files.

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.

Zox has been encoded with Base64.

HiddenWasp encrypts its configuration and payload.

XORIndex Loader has encoded module names and C2 URLs as hexadecimal strings in attempts to evade analysis.

HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.

Sliver can encrypt strings at compile time.

The DCRAT configuration file is encrypted using AES-256.

PcShare has been encrypted with XOR using different 32-long Base16 strings.

Remcos can use string encryption to hinder analysis.

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.

IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.

TeamPCP Cloud Stealer has used multi-stage payloads with double Base64-encoded scripts to evade static analysis.

Mini Shai-Hulud has used a hybrid AES-256-GCM and RSA OAEP-SHA256 encryption to archive gathered data. Mini Shai-Hulud has also utilized custom MD5-keystream XOR cipher to encrypt data. Mini Shai-Hulud has also been deployed via an obfuscated script using Bun JavaScript runtime.

BendyBear changes its runtime footprint during code execution to evade signature-based defenses.

Ninja has compressed its data with the LZSS algorithm.

RCSession can compress and obfuscate its strings to evade detection on a compromised host.

WindTail can be delivered as a compressed, encrypted, and encoded payload.

ThreatNeedle has been compressed and obfuscated.

Pony attachments have been delivered via compressed archive files.

BADHATCH can be compressed with the ApLib algorithm.

PUBLOAD has been delivered as compressed files within ZIP files to victims.