Procedure examples

TrickBot uses non-descriptive names to hide functionality.

EKANS uses encoded strings in its process kill list.

SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.

Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.

BRICKSTORM has utilized Go libraries to include Garble to obfuscate code.

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.

NOKKI uses Base64 encoding for strings.

AvosLocker has used XOR-encoded strings.

COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.

Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.

Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.

NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

BOOKWORM has been delivered using self-extracting RAR archives.

OLDBAIT obfuscates internal strings and unpacks them at startup.

TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

Turian can use VMProtect for obfuscation.

Action RAT's commands, strings, and domains can be Base64 encoded within the payload.

PUBLOAD has obfuscated DLL names using the ror13AddHash32 algorithm.

The Gootloader first stage script is obfuscated using random alpha numeric strings.

PolyglotDuke can custom encrypt strings.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

Snip3 has the ability to obfuscate strings using XOR encryption.

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.

Diavol has Base64 encoded the RSA public key used for encrypting files.

Siloscape itself is obfuscated and uses obfuscated API calls.

RustyWater has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.

HTTPTroy has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions to hinder analysis and detection.

Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.

CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.

DRATzarus can be partly encrypted with XOR.

SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.

Avaddon has used encrypted strings.

Conficker has obfuscated its code to prevent its removal from host machines.

Flagpro has been delivered within ZIP or RAR password-protected archived files.

Green Lambert has encrypted strings.

ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.

PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.

POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.

MiniDuke can use control flow flattening to obscure code.

Anchor has obfuscated code with stack strings and string encryption.

DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.