Procedure examples

PoetRAT has `pyminifier` to obfuscate scripts.

PowerPunch can use Base64-encoded scripts.

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.

QakBot can use obfuscated and encoded scripts.

CookieMiner has used base64 encoding to obfuscate scripts on the system.

Denis has encoded its PowerShell commands in Base64.

LoudMiner has obfuscated various scripts.

XORIndex Loader has obfuscated strings using ASCII buffers and TextDecoder.

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.

Empire has the ability to obfuscate commands using Invoke-Obfuscation.

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.

Quad7 Activity has infected victim network devices by storing artifacts in the /tmp directory which is volatile in memory and will clear its contents upon shutdown or restart.

APT32's backdoor has stored its configuration in a registry key.

Turla has used the Registry to store encrypted and encoded payloads.

Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

TinyTurla can save its configuration parameters in the Registry.

PolyglotDuke can store encrypted JSON configuration files in the Registry.

RegDuke can store its encryption key in the Registry.

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.

Some versions of Chaes stored its instructions (otherwise in a `instructions.ini` file) in the Registry.

TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`

PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].

Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

REvil can save encryption parameters and system information in the Registry.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.

ComRAT has stored encrypted orchestrator code and payloads in the Registry.

ShadowPad maintains a configuration block and virtual file system in the Registry.

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Gelsemium can store its components in the Registry.

Kimsuky has used the LNK icon location to execute malicious scripts. Kimsuky has also padded the LNK target field properties with extra spaces to obscure the script.

Gamaredon Group has used LNK files to hide malicious scripts for execution.

Mustang Panda has utilized LNK files to hide malicious scripts for execution. Mustang Panda has also leveraged LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

TONESHELL has been initiated using LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.