Procedure examples

Elderwood has encrypted documents and malicious executables.

Kimsuky has obfuscated code within files by converting hexadecimal strings to decimal numbers using the `CLng function` in combination with processing arithmetic operations and leveraging the `Chr function` to generate readable characters. Kimsuky has also encoded files with Base64 and RC4. Kimsuky has utilized XOR and RC4 to encode malicious payloads.

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.

TeamTNT has encrypted its binaries via AES and encoded files using Base64.

APT18 obfuscates strings in the payload.

Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.

APT39 has used malware to drop encrypted CAB files.

Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.

TA2541 has used compressed and char-encoded scripts in operations.

Moses Staff has used obfuscated web shells in their operations.

OilRig has encrypted and encoded data in its malware, including by using base64.

Higaisa used Base64 encoded compressed payloads.

Tropic Trooper has encrypted configuration files.

Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.

Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.

Leviathan has obfuscated code using base64.

Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.

Blue Mockingbird has obfuscated the wallet address in the payload binary.

TA505 has password-protected malicious Word documents.

BITTER has used a RAR SFX dropper to deliver malware.

Mofang has encrypted payloads before they are downloaded to victims.

Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.

MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.

Darkhotel has obfuscated code using RC4, XOR, and RSA.

Whitefly has encrypted the payload used for C2.

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.

Metador has encrypted their payloads.

Fox Kitten has base64 encoded payloads to avoid detection.

APT-C-36 has used encoded and obfuscated files, images, and executables.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Transparent Tribe has dropped encoded executables on compromised hosts.

Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.

Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.

APT33 has used base64 to encode payloads.

APT19 used Base64 to obfuscate payloads.