Procedure examples

Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.

Bankshot encodes commands from the control server using a range of characters and gzip.

TONESHELL has encoded a payload with a random 32-byte key using XOR. TONESHELL has also encoded payloads with a 256-byte key using XOR.

OceanSalt can encode data with a NOT operation before sending the data to the control server.

InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.

RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.

HTTPTroy has obfuscated HTTP POST request communications utilizing XOR with a designated key of 0x56, followed by Base64 encoding.

CHIMNEYSWEEP can use a custom Base64 alphabet for encoding C2.

Uroburos can use a custom base62 and a de-facto base32 encoding that uses digits 0-9 and lowercase letters a-z in C2 communications.

NightClub has used a non-standard encoding in DNS tunneling removing any `=` from the result of base64 encoding, and replacing `/` characters with `-s` and `+` characters with `-p`.

Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.

Neo-reGeorg can use modified Base64 encoding to obfuscate communications.

PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.

ShadowPad has encoded data as readable Latin characters.

Lizar has used a complex XOR operation to obfuscate C2 communications.

Newer variants of BACKSPACE will encode C2 communications with a custom system.

Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.