Procedure examples

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.

HeartCrypt can add several hundred thousand kilobytes of null padding to payloads before saving onto the file system.

TONESHELL has used randomized padding to obfuscate payloads.

Emotet inflates malicious files and malware as an evasion technique.

Snip3 can obfuscate strings using junk Chinese characters.

Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.

LightSpy's configuration file is appended to the end of the binary. For example, the last `0x1d0` bytes of one sample is an AES encrypted configuration file with a static key of `3e2717e8b3873b29`.

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.

Javali can use large obfuscated libraries to hinder detection and analysis.

PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.

Bisonal has appended random binary data to the end of itself to generate a large binary.

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.

Black Basta had added data prior to the Portable Executable (PE) header to prevent automatic scanners from identifying the payload.

Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.

Caminho can use junk code for obfuscation.

Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

GrimAgent has the ability to add bytes to change the file hash.

Goopy has had null characters padded in its malicious DLL payload.

QakBot can use large file sizes to evade detection.

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.