Procedure examples

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.

AvosLocker has used obfuscated API calls that are retrieved by their checksums.

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.

CANONSTAGER has utilized custom API hashing to obfuscate the Windows APIs being used.

CLAIMLOADER has utilized XOR-encrypted API names and native APIs of `LdrLoadDll()` and `LderGetProcedureAddress()` to resolve imports dynamically.

HTTPTroy has utilized dynamic API resolution by reconstructing API calls during runtime using combinations of arithmetic and logical operations to complicate static analysis.

CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.

Pteranodon can use a dynamic Windows hashing algorithm to map API components.

SplatDropper has leveraged hashed Windows API calls using a seed value of "131313".

PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

Latrodectus can resolve Windows APIs dynamically by hash.

LODEINFO can use a hashing algorithm to dynamically resolve API function addresses.

LP-Notes has dynamically resolved API functions during the C runtime startup.

Bazar can hash then resolve API calls at runtime.

HiddenFace can dynamically resolve Windows APIs.

Samurai can encrypt API name strings with an XOR-based algorithm.

Raccoon Stealer dynamically links key WinApi functions during execution.

Brute Ratel C4 can call and dynamically resolve hashed APIs.

macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.

Cuckoo Stealer is a stripped binary payload.

During the 3CX Supply Chain Attack, AppleJeus uses embedded .dll as apart of a chained delivery mechanism to invoke the COM class factory.

For C0021, the threat actors embedded a base64-encoded payload within a LNK file.

TA577 has used LNK files to execute embedded DLLs.

Lazarus Group has distributed malicious payloads embedded in PNG files.

Moonstone Sleet embedded payloads in trojanized software for follow-on execution.

Pikabot further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector. Other Pikabot variants include encrypted, chunked sections of the stage 2 payload in the initial loader .text section before decrypting and assembling these during execution.

macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.

Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.

BADHATCH has an embedded second stage DLL payload within the first stage of the malware.

DUSTPAN decrypts and executes an embedded payload.

Moneybird contains a configuration blob embedded in the malware itself.

IcedID has embedded malicious functionality in a legitimate DLL file.

CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.

MultiLayer Wiper contains two binaries in its resources section, MultiList and MultiWip. MultiLayer Wiper drops and executes each of these items when run, then deletes them after execution.

Netwalker's DLL has been embedded within the PowerShell script in hex format.

The SMOKEDHAM source code is embedded in the dropper as an encrypted string.

The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.

The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.

DEADWOOD contains an embedded, AES-encrypted payload labeled METADATA that provides configuration information for follow-on execution.

Dtrack has used a dropper that embeds an encrypted payload as extra data.

Invoke-PSImage can be used to embed payload data within a new image file.

CanisterWorm has used embedded second stage Base64-encoded payloads.

During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.

During Frankenstein, the threat actors ran encoded commands from the command line.

During C0018, the threat actors used Base64 to encode their PowerShell scripts.

During C0021, the threat actors used encoded PowerShell commands.

During Operation CuckooBees, the threat actors executed an encoded VBScript file.

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.