Procedure examples

Out1 has the ability to encode data.

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.

MCMD can Base64 encode output strings prior to sending to C2.

Kimsuky has performed padding of PowerShell command line code with over 100 spaces.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Moafee has been known to employ binary padding.

Akira has used binary padding to obfuscate payloads.

Higaisa performed padding with null bytes before calculating its hash.

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.

HeartCrypt can add several hundred thousand kilobytes of null padding to payloads before saving onto the file system.

TONESHELL has used randomized padding to obfuscate payloads.

Emotet inflates malicious files and malware as an evasion technique.

Snip3 can obfuscate strings using junk Chinese characters.

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.

LightSpy's configuration file is appended to the end of the binary. For example, the last `0x1d0` bytes of one sample is an AES encrypted configuration file with a static key of `3e2717e8b3873b29`.

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.

Javali can use large obfuscated libraries to hinder detection and analysis.

PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.

Bisonal has appended random binary data to the end of itself to generate a large binary.

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.

Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.

Caminho can use junk code for obfuscation.

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

GrimAgent has the ability to add bytes to change the file hash.

Goopy has had null characters padded in its malicious DLL payload.

QakBot can use large file sizes to evade detection.

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.

During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.

For Operation Dust Storm, the threat actors used UPX to pack some payloads.

For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.

During Night Dragon, threat actors used software packing in its tools.

During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.

Elderwood has packed malware payloads before delivery to victims.

GALLIUM packed some payloads using different types of packers, both known and custom.

APT3 has been known to pack their tools.

Kimsuky has packed malware with UPX.

Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.

A Patchwork payload was packed with UPX.

APT41 uses packers such as Themida to obfuscate malicious files.

TeamTNT has used UPX and Ezuri packer to pack its binaries.

ZIRCONIUM has used multi-stage packers for exploit code.