Procedure examples

IronWind has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.

Ursnif droppers execute base64 encoded PowerShell commands.

Tsundere Botnet’s MSI installer has Base64-encoded command execution.

Zeus Panda obfuscates the macro commands in its initial payload.

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.

CARROTBAT has the ability to execute obfuscated commands on the infected host.

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts.

BADHATCH malicious PowerShell commands can be encoded with base64.

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.

FruitFly executes and stores obfuscated Perl scripts.

DarkWatchman has used Base64 to encode PowerShell commands.

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.

QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.

RedLine Stealer has obfuscated scripts within text files used in execution.

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.

Sibot has obfuscated scripts used in execution.

BackConfig has used compressed and decimal encoded VBS scripts.

PHASEJAM has encoded commands with Base64.

PoetRAT has `pyminifier` to obfuscate scripts.

PowerPunch can use Base64-encoded scripts.

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.

QakBot can use obfuscated and encoded scripts.

CookieMiner has used base64 encoding to obfuscate scripts on the system.

Denis has encoded its PowerShell commands in Base64.

LoudMiner has obfuscated various scripts.

XORIndex Loader has obfuscated strings using ASCII buffers and TextDecoder.

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.

Empire has the ability to obfuscate commands using Invoke-Obfuscation.