Procedure examples

Kimsuky has encoded malicious PowerShell scripts using Base64.

Patchwork has obfuscated a script with Crypto Obfuscator.

APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

FIN6 has used encoded PowerShell commands.

Gamaredon Group has used obfuscated or encrypted scripts.

Leafminer obfuscated scripts that were used on victim machines.

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

Sidewinder has used base64 encoding for scripts.

Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.

Aquatic Panda has encoded PowerShell commands in Base64.

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

TA505 has used base64 encoded PowerShell commands.

Chimera has encoded PowerShell commands.

Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.

TA551 has used obfuscated variable names in a JavaScript configuration file.

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.

Fox Kitten has base64 encoded scripts to avoid detection.

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.

Silence has used environment variable string substitution for obfuscation.

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

HEXANE has used Base64-encoded scripts.

WIRTE has XOR encrypted command line strings to conceal malware execution chains.

Magic Hound has used base64-encoded commands.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

APT19 used Base64 to obfuscate executed commands.