Procedure examples

BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.

GlassWorm has decoded its Base64 instructions. GlassWorm has also decrypted its AES protected payloads.

Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.

Embargo has utilized MDeployer to decrypt two payloads that contain MS4Killer toolkit b.cache and the Embargo ransomware executable a.cache with a hardcoded RC4 key `wlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB`.

Bandook has decoded its PowerShell script.

PipeMon can decrypt password-protected executables.

MagicRAT stores command and control URLs using base64 encoding in the malware's configuration file.

KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.

Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.

RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter hmacTime. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.

gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.

KGH_SPY can decrypt encrypted strings and write them to a newly created folder.

Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.

RedLine Stealer has decoded its payload prior to execution.

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.

RogueRobin decodes an embedded executable using base64 and decompresses it.

SQLRat has scripts that are responsible for deobfuscating additional scripts.

MegaCortex has used a Base64 key to decode its components.

SDBbot has the ability to decrypt and decompress its payload to enable code execution.

QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.

BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file.

PHPsert has the ability to decode and decrypt obfuscated strings prior to execution.

StrelaStealer payloads have included strings encrypted via XOR. StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.

Grandoreiro can decrypt its encrypted internal strings.

WellMail can decompress scripts received from C2.

LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.

Starloader decrypts and executes shellcode from a file called Stars.jps.

VaporRage can deobfuscate XOR-encoded shellcode prior to execution.

Sibot can decrypt data received from a C2 and save to a file.

ZxxZ has used a XOR key to decrypt strings.

Caminho can deobfuscate downloaded files prior to execution.

Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.

Shark can extract and decrypt downloaded .zip files.

Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.

Kobalos decrypts strings right after the initial communication, but before the authentication process.

After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.

XLoader uses XOR and RC4 algorithms to decrypt payloads and functions. XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.

HiddenFace has the ability to decrypt its payload prior to execution.

CorKLOG has decoded XOR encrypted strings.

HermeticWiper can decompress and copy driver files using `LZCopy`.

ABK has the ability to decrypt AES encrypted payloads.

Final1stspy uses Python code to deobfuscate base64-encoded strings.

Kapeka utilizes obfuscated JSON structures for various data storage and configuration management items.

LockBit 2.0 can decode scripts and strings in loaded modules.

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.

LunarMail can decrypt strings to retrieve configuration settings.