Procedure examples

PolyglotDuke can use steganography to hide C2 information in images.

RegDuke can hide data in images, including use of the Least Significant Bit (LSB).

ProLock can use .jpg and .bmp files to store its payload.

RDAT can also embed data within a BMP image prior to exfiltration.

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.

Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.

Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.

IcedID has embedded binaries within RC4 encrypted .png files.

ObliqueRAT can hide its payload in BMP images hosted on compromised websites.

Bandook has used .PNG images within a zip file to build the executable.

LiteDuke has used image files to hide its loader component.

ABK can extract a malicious Portable Executable (PE) from a photo.

Ramsay has PE data embedded within JPEG files contained within Word documents.

build_downer can extract malware from a downloaded JPEG.

BBK can extract a malicious Portable Executable (PE) from a photo.

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.

TeamPCP has hidden malicious payloads in the frame data of WAV audio files.

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).

Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.

DarkWatchman has used the csc.exe tool to compile a C# executable.

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.

Samurai can compile and execute downloaded modules at runtime.

Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.

njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.

Sliver includes functionality to retrieve source code and compile locally prior to execution in victim environments.

In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.

During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.

GALLIUM ensured each payload had a unique hash, including by using different types of packers.

APT3 has been known to remove indicators of compromise from tools.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

UNC3886 has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.

Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.

Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.

The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.

InvisiMole has undergone regular technical improvements in an attempt to evade detection.

Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.

SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.

Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.

Penquin can remove strings from binaries.

QakBot can make small changes to itself in order to change its checksum and hash value.

Waterbear can scramble functions not to be executed again with random values.

PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.

APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.

EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.

QakBot has been delivered in ZIP files via HTML smuggling.

Kimsuky has leveraged dynamic API resolution using custom hashing techniques.

Mustang Panda has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.