Procedure examples

StrelaStealer variants have included excessive mathematical functions padding the binary and slowing execution for anti-analysis and sandbox evasion purposes.

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

ANELLDR can use junk code for payload obfuscation.

Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.

POWERSTATS has used useless code blocks to counter analysis.

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Gelsemium can use junk code to hide functions and evade detection.

GlassWorm has utilized invisible Unicode Private Use Area (PUA) characters to obfuscate its malicious code so that it does not render in code editors.

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.

Ninja can configure its agent to work only in specific time frames.

TinyTurla contacts its C2 based on a scheduled timing set in its configuration.

Machete sends stolen data to the C2 server every 10 minutes.

Kazuar can sleep for a specific time and be set to communicate at specific intervals.

ShimRat can sleep when instructed to do so by the C2.

Chrommme can set itself to sleep before requesting a new command from C2.

Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.

LightNeuron can be configured to exfiltrate data during nighttime or working hours.

Shark can pause C2 communications for a specified time.

Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).

Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.

POWERSTATS can sleep for a given number of seconds.

Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.

ShadowPad has sent data back to C2 every 8 hours.

jRAT can be configured to reconnect at certain intervals.

ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.

During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.

APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.

APT28 has split archived exfiltration files into chunks smaller than 1MB.

Play has split victims' files into chunks for exfiltration.

Threat Group-3390 actors have split RAR files for exfiltration into parts.

AppleSeed has divided files if the size is 0x1000000 bytes or more.

RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.

ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.

POSHSPY uploads data in 2048-byte chunks.

Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .

OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.

Cobalt Strike will break large data sets into smaller chunks for exfiltration.

Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.

StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.

Kevin can exfiltrate data to the C2 server in 27-character chunks.

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.

Mythic supports custom chunk sizes used to upload/download files.

During SharePoint ToolShell Exploitation, threat actors executed `whoami` on victim machines to enumerate user context and validate privilege levels.

During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.

During C0018, the threat actors collected `whoami` information via PowerShell scripts.