Procedure examples

Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.

SystemBC has encoded with XOR and encrypted with RC4 its beacon.

FlawedAmmyy may obfuscate portions of the initial C2 handshake.

RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.

StrelaStealer encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.

FRAMESTING can send and receive zlib compressed data within `POST` requests.

TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.

FunnyDream can send compressed and obfuscated packets to C2.

SideTwist can embed C2 responses in the source code of a fake Flickr webpage.

SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.

evilginx2 can modify the Origin and Referrer fields in HTTPS headers it relays between intended victims and legitimate websites to comply with cross-origin resource sharing (CORS) restrictions.

Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.

UPSTYLE retrieves a non-existent webpage from the command and control server then parses commands from the resulting error logs to decode commands to the web shell.

Turian can insert pseudo-random characters into its network encryption setup.

WellMess can use junk data in the Base64 string for additional obfuscation.

GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.

BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.

LODEINFO can append C2 communication with randomly generated junk data.

P8RAT can send randomly-generated data as part of its C2 communication.

Mori has obfuscated the FML.dll with 200MB of junk data.

BendyBear has used byte randomization to obscure its behavior.

Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.

SUNBURST added junk bytes to its C2 over HTTP.

P2P ZeuS added junk data to outgoing UDP packets to peer implants.

PLEAD samples were found to be highly obfuscated with junk code.

TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.

GrimAgent can pad C2 messages with random generated values.

Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.

LunarWeb can receive C2 commands hidden in the structure of .jpg and .gif images.

HAMMERTOSS is controlled via commands that are appended to image files.

Sliver can encode binary data into a .PNG file for C2 communication.

Zox has used the .PNG file format for C2 communications.

LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.

ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.

Daserf can use steganography to hide malicious code downloaded to the victim.

RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.

LunarMail can parse IDAT chunks from .png files to look for zlib-compressed and AES encrypted C2 commands.

When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.

SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.

Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. TONESHELL variants have utilized FakeTLS headers with the bytes `0x17 0x03 0x03` to represent TLSv1.2 and `0x17 0x03 0x04` for TLSv1.3.

BOOKWORM has modified HTTP POST requests to resemble legitimate communications.

PUBLOAD has modified HTTP POST requests to resemble legitimate communications. PUBLOAD used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. PUBLOAD has utilized FakeTLS headers with the bytes 17 03 03.

InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.

TAINTEDSCRIBE has used FakeTLS for session authentication.