Obfuscated Files or Information

Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.^[7][8]

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.^[9] Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.^[10]

Anchor has obsuscated code with stack strings and string encryption.^[11]

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.^[12]

APT18 obfuscates strings in the payload.^[13]

APT19 used Base64 to obfuscate commands and the payload.^[14]

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.^{[8][15][16][17][18]}

APT29 uses PowerShell to use Base64 for obfuscation.^[19]

APT3 obfuscates files or information to help evade defensive measures.^[20]

APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation. APT32 has also encoded payloads using Base64 and a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.^{[21][22][23][24][25][26][27]}

APT33 has used base64 to encode payloads.^[28]

APT37 obfuscates strings and payloads.^[29][30]

APT41 used VMProtected binaries in multiple intrusions.^[31]

Aria-body has used an encrypted configuration file for its loader.^[32]

Astaroth obfuscates its JScript code.^[33]

Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.^[34]

AuditCred encrypts the configuration.^[35]

Avenger has the ability to XOR encrypt files to be sent to C2.^[36]

BackConfig has used compressed and decimal encoded VBS scripts.^[37]

Bisonal's DLL file and non-malicious decoy file are encrypted with RC4.^[38]

BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.^[39]

Blue Mockingbird has obfuscated the wallet address in the payload binary.^[40]

BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.^[41]

Bundlore has obfuscated data with base64, AES, RC4, and bz2.^[42]

Carbanak encrypts strings to make analysis more difficult.^[43]

Carberp has used XOR-based encryption to mask C2 server locations within the trojan.^[44]

Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.^[45]

Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.^[46]

CARROTBALL has used a custom base64 alphabet to decode files.^[47]

CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.^[48]

Chimera has encoded PowerShell commands.^[49]

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.^[50][51]

CoinTicker initially downloads a hidden encoded file.^[52]

Comnie uses RC4 and Base64 to obfuscate strings.^[53]

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also embedded an XOR encrypted communications module inside the orchestrator module. ComRAT has encrypted its virtual file system using AES-256 in XTS mode.^[54]

CookieMiner has used base64 encoding to obfuscate scripts on the system.^[55]

CORESHELL obfuscates strings using a custom stream cipher.^[56]

The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.^[57]

Dacls can encrypt its configuration file with AES CBC.^[58]

Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.^[59]

Darkhotel has obfuscated code used in an operation using RC4 and other methods.^[60]

Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.^[61]

Denis obfuscates its code and encrypts the API names. Denis also encodes its payload in Base64.^[62][25]

DOGCALL is encrypted using single-byte XOR.^[63]

Drovorub has used XOR encrypted payloads in WebSocket client to server messages.^[64]

Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.^[65]

The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.^[66]

Ebury has obfuscated its strings with a simple XOR encryption with a static key.^[67]

Elderwood has encrypted documents and malicious executables.^[68]

Elise encrypts several of its files, including configuration files.^[69]

Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.^[70][71]

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts. ^{[72][73][74][75]}

Empire has the ability to obfuscate commands using Invoke-Obfuscation.^[76]

Epic heavily obfuscates its code to make analysis more difficult.^[77]

Exaramel for Linux uses RC4 for encrypting the configuration.^[78]

FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.^[79]

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.^[80][81]

FIN6 has used encoded PowerShell commands.^[82]

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.^[4][83]

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.^[4][84]

Final1stspy obfuscates strings with base64 encoding.^[63]

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.^[85][86]

FlawedGrace encrypts its C2 configuration files with AES in CBC mode.^[87]

Frankenstein has run encoded commands from the command line.^[88]

FruitFly executes and stores obfuscated Perl scripts.^[89]

Fysbis has been encrypted using XOR and RC4.^[90]

Gallmaker obfuscated shellcode used during execution.^[91]

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.^[92]

Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.^[93]

GoldenSpy's uninstaller has base64-encoded its variables. ^[94]

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.^[25]

GravityRAT supports file encryption (AES with the key "lolomycin2017").^[95]

GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.^[81]

Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.^[96]

H1N1 uses multiple techniques to obfuscate strings, including XOR.^[97]

Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.^[98][99]

HAWKBALL has encrypted the payload with an XOR-based algorithm.^[100]

The Helminth config file is encrypted with RC4.^[101]

Hi-Zor uses various XOR techniques to obfuscate its components.^[102]

HiddenWasp encrypts its configuration and payload.^[103]

Some strings in HOMEFRY are obfuscated with XOR x56.^[104]

Honeybee drops files with base64-encoded data.^[105]

HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.^[106]

HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.^[107]

Hydraq uses basic obfuscation in the form of spaghetti code.^[68][108]

IcedID has utilzed encrypted binaries and base64 encoded strings.^[109]

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.^[12]

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.^[110]

InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.^[111]

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.^[112][113]

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.^[114]

ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.^[115]

Many strings in JHUHUGIT are obfuscated with a XOR algorithm.^{[116][117][17]}

A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.^[118]

jRAT’s Java payload is encrypted with AES.^[119] Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.^[120]

Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.^[121]

Kessel's configuration is hardcoded and RC4 encrypted within the binary.^[122]

In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.^[123]

Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.^[124]

Lazarus Group malware uses multiple types of encryption and encoding in its malware files, including AES, Caracachs, RC4, basic XOR with constant 0xA7, and other techniques.^{[125][126][127][128][58]}

Leafminer obfuscated scripts that were used on victim machines.^[129]

Leviathan has obfuscated code using base64 and gzip compression.^[130]

LightNeuron encrypts its configuration files with AES-256.^[131]

Lokibot has obfuscated strings with base64 encoding.^[132]

LoudMiner has obfuscated various scripts and encrypted DMG files.^[133]

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation.^[134]

Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.^[135]

Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.^[136]

Matroyshka obfuscates API function names using a substitute cipher combined with Base64 encoding.^[137]

Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.^[138]

MCMD can Base64 encode output strings prior to sending to C2.^[139]

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.^[140][141]

Metamorfo has obfuscated and encrypted some payloads.^[142]

Micropsia obfuscates the configuration with a custom Base64 and XOR.^[143][144]

MiniDuke can use control flow flattening to obscure code.^[79]

Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.^[145]

Molerats has delivered compressed executables within ZIP files to victims.^[146]

Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.^[147]

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework.^[148][22] The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.^{[148][149][150][151][152]}

NanHaiShu encodes files in Base64.^[153]

NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.^[154]

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables. Netwalker's DLL has also been embedded within the PowerShell script in hex format.^[155][156]

A Night Dragon DLL included an XOR-encoded section.^[157]

njRAT has included a base64 encoded executable.^[158]

NOKKI uses Base64 encoding for strings.^[159]

OilRig has encrypted and encoded data in its malware, including by using base64.^{[160][161][162][163][164]}

OLDBAIT obfuscates internal strings and unpacks them at startup.^[56]

OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.^[165][166]

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.^[130]

OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.^[167]

Patchwork has obfuscated a script with Crypto Obfuscator.^[168]

Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.^[169]

PipeMon modules are stored encrypted on disk.^[170]

Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.^[171]

PoetRAT has used a custom encryption scheme for communication between scripts.^[172]

PoisonIvy hides any strings related to its own indicators of compromise.^[173]

PolyglotDuke can custom encrypt strings.^[79]

Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.^[174]

POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.^[175]

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.^[176][177]

PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.^[178]

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. ^[149][179] POWERSTATS has used PowerShell code with custom string obfuscation ^[180]

Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.^[181]

PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.^[182]

PUNCHTRACK is loaded and executed by a highly obfuscated launcher.^[183]

Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.^[184]

QUADAGENT was likely obfuscated using Invoke-Obfuscation.^[161][22]

Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.^[185][186]

Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.^[187]

Reaver encrypts some of its files with XOR.^[188]

A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.^[189]

RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.^[79]

Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.^[190]

Remexi obfuscates its configuration data with XOR.^[191]

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.^[192][193]

REvil has used encrypted strings and configuration files.^{[194][195][196][197][198][199][200]}

Rifdoor has encrypted strings with a single byte XOR algorithm.^[106]

Configuration data used by Rising Sun is encrypted using RC4.^[201]

Rocke has modified UPX headers after packing files to break unpackers.^[202]

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.^[203][22]

RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.^[204][205]

Sakula uses single-byte XOR obfuscation to obfuscate many of its files.^[206]

SamSam has been seen using AES or DES to encrypt payloads and payload components.^[207][208]

Sandworm Team has used Base64 encoding within malware variants. Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.^[209][210]

SDBot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.^[211]

Seasalt obfuscates configuration data.^[212]

Shamoon contains base64-encoded strings.^[213]

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.^[180]

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.^[145]

ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.^[145]

SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.^[214][215]

Silence has used environment variable string substitution for obfuscation.^[216]

Skidmap has encrypted it's main payload using 3DES.^[217]

Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.^[218][219]

Soft Cell used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.^[220]

SoreFang has the ability to encode and RC6 encrypt data sent to C2.^[221]

SpeakUp encodes its second-stage payload with Base64. ^[222]

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.^[223]

StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.^[224]

StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.^[225]

StrongPity has used encrypted strings in its dropper component.^[226][227]

Sunburst strings were compressed and encoded in Base64.^[228] Sunburst also obfuscated collected system information using a FNV-1a + XOR algorithm.^[229]

Sunspot encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for Sunburst source code and data extracted from the SolarWinds Orion process.^[230]

SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.^[231][232]

TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.^{[233][234][235]}

TajMahal has used an encrypted Virtual File System to store plugins.^[236]

Teardrop created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.^{[229][237][186]}

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^{[238][239][240]}

TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.^[241]

TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.^[242]

Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.^[243]

Tropic Trooper has encrypted configuration files.^[244][245]

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.^[178]

APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.^[246]

UBoatRAT encrypts instructions in the payload using a simple XOR cipher.^[247]

UNC2452 used encoded PowerShell commands.^[248]

Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.^[249] Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.^[250]

Most strings in USBStealer are encrypted using 3DES and XOR and reversed.^[251]

Valak has the ability to base64 encode and XOR encrypt strings.^{[252][253][254]}

VERMIN is obfuscated using the obfuscation tool called ConfuserEx.^[255]

A Volgmer variant is encoded using a simple XOR cipher.^[256]

Whitefly has encrypted the payload used for C2.^[257]

WindTail can be delivered as a compressed, encrypted, and encoded payload.^[258]

Winnti for Linux can encode its configuration file with single-byte XOR encoding.^[259]

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.^[260][261]

A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.^[262]

YAHOYAH encrypts its configuration file using a simple algorithm.^[263]

ZeroT has encrypted its payload with RC4.^[264]

Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4.^[265][266]

Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10 to analyze commands after being processed/interpreted. ^[267]