Procedure examples

Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.

SystemBC has encoded with XOR and encrypted with RC4 its beacon.

FlawedAmmyy may obfuscate portions of the initial C2 handshake.

RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.

StrelaStealer encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.

FRAMESTING can send and receive zlib compressed data within `POST` requests.

TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.

FunnyDream can send compressed and obfuscated packets to C2.

SideTwist can embed C2 responses in the source code of a fake Flickr webpage.

SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.

evilginx2 can modify the Origin and Referrer fields in HTTPS headers it relays between intended victims and legitimate websites to comply with cross-origin resource sharing (CORS) restrictions.