Procedure examples

TA2541 has used compressed and char-encoded scripts in operations.

Higaisa used Base64 encoded compressed payloads.

Leviathan has obfuscated code using gzip compression.

Mofang has compressed the ShimRat executable within malicious email attachments.

Molerats has delivered compressed executables within ZIP files to victims.

VOID MANTICORE has compressed their payloads by leveraging zip files.

WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.

Threat Group-3390 malware is compressed with LZNT1 compression.

Ninja has compressed its data with the LZSS algorithm.

RCSession can compress and obfuscate its strings to evade detection on a compromised host.

WindTail can be delivered as a compressed, encrypted, and encoded payload.

ThreatNeedle has been compressed and obfuscated.

Pony attachments have been delivered via compressed archive files.

BADHATCH can be compressed with the ApLib algorithm.

PUBLOAD has been delivered as compressed files within ZIP files to victims.

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.

DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.

LODEINFO components have been compressed with zip for delivery.

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

StrelaStealer has been delivered via JScript files in a ZIP archive.

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

Pandora has the ability to compress stings with QuickLZ.

SUNBURST strings were compressed and encoded in Base64.

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.

Pillowmint has been compressed and stored within a registry key.

Winnti for Windows has the ability to encrypt and compress its payload.

Hancitor has delivered compressed payloads in ZIP files to victims.

Gelsemium has the ability to compress its components.

PcShare has been compressed with LZW algorithm.

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.

Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.

APT32 includes garbage code to mislead anti-malware software and researchers.

Gamaredon Group has obfuscated .NET executables by inserting junk code.

FIN7 has used random junk code to obfuscate malware code.

Mustang Panda has used junk code within their DLL files to hinder analysis.

APT-C-36 has used junk characters to obfuscate malicious scripts.

yty contains junk code in its binary, likely to confuse malware analysts.

Pony obfuscates memory flow by adding junk instructions when executing to make analysis more difficult.

WastedLocker contains junk code to increase its entropy and hide the actual code.

ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.

SamSam has used garbage code to pad some of its malware components.

FatDuke has been packed with junk code and strings.

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.

NOOPLDR can insert junk code to obfuscate malicious payloads.

PureCrypter can insert junk code to avoid detection.

A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.

LODEINFO has inserted junk code to obstruct code analysis.