Procedure examples

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.

DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.

LODEINFO components have been compressed with zip for delivery.

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

StrelaStealer has been delivered via JScript files in a ZIP archive.

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

Pandora has the ability to compress stings with QuickLZ.

SUNBURST strings were compressed and encoded in Base64.

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.

Pillowmint has been compressed and stored within a registry key.

Winnti for Windows has the ability to encrypt and compress its payload.

Hancitor has delivered compressed payloads in ZIP files to victims.

Gelsemium has the ability to compress its components.

PcShare has been compressed with LZW algorithm.

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.

yty contains junk code in its binary, likely to confuse malware analysts.

Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.

WastedLocker contains junk code to increase its entropy and hide the actual code.

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.

SamSam has used garbage code to pad some of its malware components.

FatDuke has been packed with junk code and strings.

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.

NOOPLDR can insert junk code to obfuscate malicious payloads.

PureCrypter can insert junk code to avoid detection.

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.

LODEINFO has inserted junk code to obstruct code analysis.

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

ANELLDR can use junk code for payload obfuscation.

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.

POWERSTATS has used useless code blocks to counter analysis.

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Gelsemium can use junk code to hide functions and evade detection.

GlassWorm has utilized invisible Unicode Private Use Area (PUA) characters to obfuscate its malicious code so that it does not render in code editors.

Ninja can configure its agent to work only in specific time frames.

TinyTurla contacts its C2 based on a scheduled timing set in its configuration.

Machete sends stolen data to the C2 server every 10 minutes.

Kazuar can sleep for a specific time and be set to communicate at specific intervals.

ShimRat can sleep when instructed to do so by the C2.

Chrommme can set itself to sleep before requesting a new command from C2.

Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.

LightNeuron can be configured to exfiltrate data during nighttime or working hours.

Shark can pause C2 communications for a specified time.

Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).

Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.

POWERSTATS can sleep for a given number of seconds.