Procedure examples

Pikabot further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector. Other Pikabot variants include encrypted, chunked sections of the stage 2 payload in the initial loader .text section before decrypting and assembling these during execution.

macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.

Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.

DUSTTRAP contains additional embedded DLLs and configuration files that are loaded into memory during execution.

BADHATCH has an embedded second stage DLL payload within the first stage of the malware.

DUSTPAN decrypts and executes an embedded payload.

Moneybird contains a configuration blob embedded in the malware itself.

IcedID has embedded malicious functionality in a legitimate DLL file.

CHIMNEYSWEEP can extract RC4 encrypted embedded payloads for privilege escalation.

MultiLayer Wiper contains two binaries in its resources section, MultiList and MultiWip. MultiLayer Wiper drops and executes each of these items when run, then deletes them after execution.

Netwalker's DLL has been embedded within the PowerShell script in hex format.

The SMOKEDHAM source code is embedded in the dropper as an encrypted string.

The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.

The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.

DEADWOOD contains an embedded, AES-encrypted payload labeled METADATA that provides configuration information for follow-on execution.

Dtrack has used a dropper that embeds an encrypted payload as extra data.

Invoke-PSImage can be used to embed payload data within a new image file.

CanisterWorm has used embedded second stage Base64-encoded payloads.