Procedure examples

Kimsuky has encoded malicious PowerShell scripts using Base64.

Patchwork has obfuscated a script with Crypto Obfuscator.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

FIN6 has used encoded PowerShell commands.

Gamaredon Group has used obfuscated or encrypted scripts.

Leafminer obfuscated scripts that were used on victim machines.

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

Sidewinder has used base64 encoding for scripts.

Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.

Aquatic Panda has encoded PowerShell commands in Base64.

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

TA505 has used base64 encoded PowerShell commands.

Chimera has encoded PowerShell commands.

Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.

TA551 has used obfuscated variable names in a JavaScript configuration file.

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.

Fox Kitten has base64 encoded scripts to avoid detection.

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.

Silence has used environment variable string substitution for obfuscation.

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

HEXANE has used Base64-encoded scripts.

WIRTE has XOR encrypted command line strings to conceal malware execution chains.

Magic Hound has used base64-encoded commands.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

APT19 used Base64 to obfuscate executed commands.

IronWind has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.

Ursnif droppers execute base64 encoded PowerShell commands.

Tsundere Botnet’s MSI installer has Base64-encoded command execution.

Zeus Panda obfuscates the macro commands in its initial payload.

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.

CARROTBAT has the ability to execute obfuscated commands on the infected host.

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts.

BADHATCH malicious PowerShell commands can be encoded with base64.

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.

FruitFly executes and stores obfuscated Perl scripts.

DarkWatchman has used Base64 to encode PowerShell commands.

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.

QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.

RedLine Stealer has obfuscated scripts within text files used in execution.

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.

Sibot has obfuscated scripts used in execution.

BackConfig has used compressed and decimal encoded VBS scripts.

PHASEJAM has encoded commands with Base64.