Procedure examples

BabyShark has the ability to decode downloaded files prior to execution.

The Winnti for Windows dropper can decrypt and decompresses a data blob.

Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.

PITSTOP can deobfuscate base64 encoded and AES encrypted commands.

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.

IceApple can use a Base64-encoded AES key to decrypt tasking.

metaMain can decrypt and load other modules.

SideTwist can decode and decrypt messages received from C2.

KOCTOPUS has deobfuscated itself before executing its commands.

Heyoka Backdoor can decrypt its payload prior to execution.

BRUSHFIRE has decrypted XOR strings prior to execution.

LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.

AppleJeus has decoded files received from a C2.

SoreFang can decode and decrypt exfiltrated data sent to C2.

MirageFox has a function for decrypting data containing C2 configuration information.

Industroyer decrypts code to connect to a remote C2 server.

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.

POWERSTATS can deobfuscate the main backdoor code.

StarProxy has decrypted network packets using a custom algorithm.

Goopy has used a polymorphic decryptor to decrypt itself at runtime.

ShadowPad has decrypted a binary blob to start execution.

Remexi decrypts the configuration data using XOR with 25-character keys.

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.

QakBot can deobfuscate and re-assemble code strings for execution.

DOWNIISSA can decode strings prior to execution.

CookieMiner has used Google Chrome's decryption and extraction operations.

Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.

Gelsemium can decompress and decrypt DLLs and shellcode.

BBK has the ability to decrypt AES encrypted payloads.

OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.

Denis will decrypt important strings used for C&C communication.

INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.

DEADWOOD XORs some strings within the binary using the value 0xD5, and deobfuscates these items at runtime.

Waterbear has the ability to decrypt its RC4 encrypted payload for execution.

FIVEHANDS has the ability to decrypt its payload prior to execution.

Lizar has decrypted its configuration data, such as the C2 IP address, ports and other network communication.

Dtrack has used a decryption routine that is part of an executable physical patch.

Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.

HiddenWasp uses a cipher to implement a decoding function.

WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.

XORIndex Loader can decode its payload prior to execution.

certutil has been used to decode binaries hidden inside certificate files as Base64 information.

PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.

Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.

Imminent Monitor has decoded malware components that are then dropped to the system.

IronNetInjector has the ability to decrypt embedded .NET and PE payloads.

Expand can be used to decompress a local or remote CAB file into an executable.

TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.

CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.