Procedure examples

Ninja has compressed its data with the LZSS algorithm.

RCSession can compress and obfuscate its strings to evade detection on a compromised host.

WindTail can be delivered as a compressed, encrypted, and encoded payload.

ThreatNeedle has been compressed and obfuscated.

Pony attachments have been delivered via compressed archive files.

BADHATCH can be compressed with the ApLib algorithm.

PUBLOAD has been delivered as compressed files within ZIP files to victims.

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.

Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.

DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.

LODEINFO components have been compressed with zip for delivery.

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

StrelaStealer has been delivered via JScript files in a ZIP archive.

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

Pandora has the ability to compress stings with QuickLZ.

SUNBURST strings were compressed and encoded in Base64.

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.

Pillowmint has been compressed and stored within a registry key.

Winnti for Windows has the ability to encrypt and compress its payload.

Hancitor has delivered compressed payloads in ZIP files to victims.

Gelsemium has the ability to compress its components.

PcShare has been compressed with LZW algorithm.

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.