Procedure examples

TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

BLINDINGCAN has obfuscated code using Base64 encoding.

The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA`.

BRICKSTORM has utilized XOR cipher encryption to hide key strings within their code, to include IPv4 addresses of public DNS-over-HTTPS (DOH) servers.

Torisma has been Base64 encoded and AES encrypted.

DOGCALL is encrypted using single-byte XOR.

Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.

MEDUSA can XOR encrypt configuration strings.

VersaMem encrypted captured credentials with AES then Base64 encoded them before writing to local storage.

Chinoxy has encrypted its configuration file.

PAKLOG has utilized a simple encoding mechanism to encode characters in the buffer.

Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.

WindTail can be delivered as a compressed, encrypted, and encoded payload.

Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.

Exaramel for Linux uses RC4 for encrypting the configuration.

HAWKBALL has encrypted the payload with an XOR-based algorithm.

PS1 is distributed as a set of encrypted files and scripts.

HeartCrypt strings are encrypted via a single-byte XOR operation rotating over a hard-coded key, possibly provided by the PaaS customers.

Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk. Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.

ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.

RansomHub has an encrypted configuration file.

A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.

Tsundere Botnet’s loader contained AES-CBC/PKCS7 encrypted blobs, which were descrypted and written to disk.

Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.

CARROTBAT has the ability to download a base64 encoded payload.

GravityRAT supports file encryption (AES with the key "lolomycin2017").

InvisibleFerret has utilized the XOR and Base64 encoding for each of its modules. InvisibleFerret has also obfuscated files with a combination of zlib, Base64 and reverse string order. InvisibleFerret has also utilized the XOR and Base64 encoding some of its Python scripts.

StrongPity has used encrypted strings in its dropper component.

AuditCred encrypts the configuration.

ROAMINGHOUSE can embed a ZIP file containing UPPERCUT components into three base64 encoded parts.

UPSTYLE stores primary content as base64-encoded objects.

Medusa Ransomware has utilized XOR encrypted strings.

RainyDay has downloaded as a XOR-encrypted payload.

PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.

BOOKWORM has utilized Base64 encoding to obfuscate its payload.

EnvyScout can Base64 encode payloads.

GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.

Aria-body has used an encrypted configuration file for its loader.

Emotet uses obfuscated URLs to download a ZIP file.

DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.

Avenger has the ability to XOR encrypt files to be sent to C2.

DUSTPAN decrypts an embedded payload.

Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.

Dacls can encrypt its configuration file with AES CBC.

Woody RAT has used Base64 encoded strings and scripts.

Mafalda has been obfuscated and contains encrypted functions.

Squirrelwaffle has been obfuscated with a XOR-based algorithm.

HexEval Loader has encoded module names and C2 URLs as hexadecimal strings in attempts to evade analysis.

Hildegard has encrypted an ELF file.

FlawedGrace encrypts its C2 configuration files with AES in CBC mode.