Procedure examples

Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.

UPSTYLE retrieves a non-existent webpage from the command and control server then parses commands from the resulting error logs to decode commands to the web shell.

Turian can insert pseudo-random characters into its network encryption setup.

WellMess can use junk data in the Base64 string for additional obfuscation.

GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.

BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.

LODEINFO can append C2 communication with randomly generated junk data.

P8RAT can send randomly-generated data as part of its C2 communication.

Mori has obfuscated the FML.dll with 200MB of junk data.

BendyBear has used byte randomization to obscure its behavior.

Uroburos can add extra characters in encoded strings to help mimic DNS legitimate requests.

SUNBURST added junk bytes to its C2 over HTTP.

P2P ZeuS added junk data to outgoing UDP packets to peer implants.

PLEAD samples were found to be highly obfuscated with junk code.

TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.

GrimAgent can pad C2 messages with random generated values.

Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.