Procedure examples

Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions. The Cobalt Strike loader component can also decrypt the .bss section of the Beacon binary prior to execution.

SampleCheck5000 can decode and decrypt command line strings and files received through C2.

REvil can decode encrypted strings to enable execution of commands and payloads.

Valak has the ability to decode and decrypt downloaded files.

OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.

OilBooster can Base64-decode and XOR-decrypt C2 commands taken from JSON files.

OnionDuke can use a custom decryption algorithm to decrypt strings.

Taidoor can use a stream cipher to decrypt stings used by the malware.

Cyclops Blink can decrypt and parse instructions sent from C2.

NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.

Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.

Carbon decrypts task and configuration files for execution.

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.

DanBot can use a VBA macro to decode its payload prior to installation and execution.

RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.

Ramsay can extract its agent from the body of a malicious document.

The AshTag stager compoment can decode and decrypt Base64 and XOR-encrypted payloads.

FRAMESTING can decompress data received within `POST` requests.

Pillowmint has been decompressed by included shellcode prior to being launched.

MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.

ROADSWEEP can decrypt embedded scripts prior to execution.

SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.

MOPSLED can decrypt obfuscated configuration files.

More_eggs will decode malware components that are then dropped to the system.

SysUpdate can deobfuscate packed binaries in memory.

BackConfig has used a custom routine to decrypt strings.

PowGoop can decrypt PowerShell scripts for execution.

ANELLDR can decrypt encrypted payload data using AES-256-CBC and subsequently execute the payload in memory.

Kwampirs decrypts and extracts a copy of its main DLL payload when executing.

BoomBox can decrypt AES-encrypted files downloaded from C2.

DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.

Proton uses an encrypted file to store commands and configuration values.

LAMEHUG can decode and drop a decoy file attached to spearphishing emails.

WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.

Kessel has decrypted the binary's configuration once the main function was launched.

GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.

LookBack has a function that decrypts malicious data.

STEADYPULSE can URL decode key/value pairs sent over C2.

PHASEJAM has the ability to decode Base64 commands and data.

Clop has used a simple XOR operation to decrypt strings.

YAHOYAH decrypts downloaded files before execution.

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.

Egregor has been decrypted before execution.

PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.

StealBit can deobfuscate loaded modules prior to execution.

RIFLESPINE can deobfuscate encrypted files prior to execution on targeted hosts.

SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.

CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.

DDKONG decodes an embedded configuration using XOR.

SPAWNCHIMERA has decoded a XOR encoded private key.