Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

One such example is use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. ^[1] Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. ^[2]

Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ^[3]

ID: T1140

Sub-techniques: No sub-techniques

Tactic: Defense Evasion

Platforms: Linux, Windows, macOS

Permissions Required: User

Data Sources: File monitoring, Process command-line parameters, Process monitoring

Defense Bypassed: Anti-virus, Host intrusion prevention systems, Network intrusion detection system, Signature-based detection

Contributors: Matthew Demaske, Adaptforward; Red Canary

Version: 1.1

Created: 14 December 2017

Last Modified: 09 July 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
ABK	ABK has the ability to decrypt AES encrypted payloads.^[69]
Agent Tesla	Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.^[63]
APT19	An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[91]
APT28	An APT28 macro uses the command `certutil -decode` to decode contents of a .txt file storing the base64 encoded payload.^[92]^[93]
Aria-body	Aria-body has the ability to decrypt the loader configuration and payload DLL.^[64]
Astaroth	Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. ^[42]
AuditCred	AuditCred uses XOR and RC4 to perform decryption on the code functions.^[27]
Avenger	Avenger has the ability to decrypt files downloaded from C2.^[69]
Azorult	Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[30]^[31]
BackConfig	BackConfig has used a custom routine to decrypt strings.^[72]
Bankshot	Bankshot decodes embedded XOR strings.^[16]
BBK	BBK has the ability to decrypt AES encrypted payloads.^[69]
BBSRAT	BBSRAT uses Expand to decompress a CAB file into executable content.^[41]
Bisonal	Bisonal decodes strings in the malware using XOR and RC4.^[6]
BOOSTWRITE	BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.^[55]
BRONZE BUTLER	BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[82]
Bundlore	Bundlore has used `openssl` to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.^[77]
Carbon	Carbon decrypts task and configuration files for execution.^[28]
Cardinal RAT	Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[39]
certutil	certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]
CoinTicker	CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[45]
ComRAT	ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.^[76]
Darkhotel	Darkhotel has decrypted strings and imports using RC4 during execution.^[90]
DDKONG	DDKONG decodes an embedded configuration using XOR.^[17]
Denis	Denis will decrypt important strings used for C&C communication.^[40]
Dyre	Dyre decrypts resources needed for targeting the victim.^[21]^[22]
Expand	Expand can be used to decompress a local or remote CAB file into an executable.^[4]
Final1stspy	Final1stspy uses Python code to deobfuscate base64-encoded strings.^[10]
FinFisher	FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[19]^[20]
Frankenstein	Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.^[96]
Gamaredon Group	Gamaredon Group tools decrypted additional payloads from the C2.^[98]
Goopy	Goopy has used a polymorphic decryptor to decrypt itself at runtime.^[40]
Gorgon Group	Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[88]
HiddenWasp	HiddenWasp uses a cipher to implement a decoding function.^[50]
Honeybee	Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.^[83]
Imminent Monitor	Imminent Monitor has decoded malware components that are then dropped to the system.^[5]
InvisiMole	InvisiMole can decrypt, unpack and load a DLL from its resources.^[14]
ISMInjector	ISMInjector uses the `certutil` command to decode a payload file.^[23]
KONNI	KONNI has used certutil to download and decode base64 encoded strings.^[56]
Kwampirs	Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[24]
Leviathan	Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[79]
LightNeuron	LightNeuron has used AES and XOR to decrypt configuration files and commands.^[51]
Machete	Machete’s downloaded data is decrypted using AES.^[53]
menuPass	menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used `certutil -decode` to decode files on the victim’s machine when dropping UPPERCUT.^[86]^[87]
MESSAGETAP	After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. ^[60]
Metamorfo	Upon execution, Metamorfo has unzipped itself after being downloaded to the system.^[75]
MirageFox	MirageFox has a function for decrypting data containing C2 configuration information.^[11]
Molerats	Molerats decompresses ZIP files once on the victim machine.^[97]
More_eggs	More_eggs will decode malware components that are then dropped to the system.^[54]
MuddyWater	MuddyWater decoded base64-encoded PowerShell commands using a VBS file.^[84]^[85]^[7]
Netwalker	Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.^[65]
NOKKI	NOKKI uses a unique, custom de-obfuscation technique.^[8]
OilRig	A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^[78]^[23]^[32]
Okrum	Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.^[59]
OopsIE	OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[32]
OSX/Shlayer	OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.^[52]
PlugX	PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^[9]
POWERSTATS	POWERSTATS can deobfuscate the main backdoor code.^[7]
Proton	Proton uses an encrypted file to store commands and configuration values.^[38]
PUNCHBUGGY	PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.^[47]
QUADAGENT	QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[12]
Ramsay	Ramsay can extract its agent from the body of a malicious document.^[70]
Remexi	Remexi decrypts the configuration data using XOR with 25-character keys.^[43]
RGDoor	RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[15]
Rising Sun	Rising Sun decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.^[61]
Rocke	Rocke has extracted tar.gz files after downloading them from a C2 server.^[101]
RogueRobin	RogueRobin decodes an embedded executable using base64 and decompresses it.^[44]
Sandworm Team	Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.^[99]^[100]
SDBot	SDBot has the ability to decrypt and decompress its payload to enable code execution.^[66]^[67]
Shamoon	Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.^[71]
ShimRat	ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.^[62]
Skidmap	Skidmap has the ability to download, unpack, and decrypt tar.gz files .^[74]
Smoke Loader	Smoke Loader deobfuscates its code.^[13]
SQLRat	SQLRat has scripts that are responsible for deobfuscating additional scripts.^[49]
Starloader	Starloader decrypts and executes shellcode from a file called Stars.jps.^[18]
Threat Group-3390	During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[89]
TrickBot	TrickBot decodes the configuration data and modules.^[26]
Tropic Trooper	Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.^[80]^[81]
TSCookie	TSCookie has the ability to decrypt, load, and execute a DLL and its resources.^[58]
Turla	Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.^[95]
TYPEFRAME	One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[37]
Ursnif	Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.^[46]
Valak	Valak has the ability to decode and decrypt downloaded files.^[73]
VERMIN	VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[25]
Volgmer	Volgmer deobfuscates its strings and APIs once its executed.^[34]
WindTail	WindTail has the ability to decrypt strings using hard-coded AES keys.^[68]
Winnti for Linux	Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.^[57]
WIRTE	WIRTE has decoded a base64 encoded document which was embedded in a VBS script.^[94]
YAHOYAH	YAHOYAH decrypts downloaded files before execution.^[48]
Zebrocy	Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.^[35]^[36]
ZeroT	ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[33]
Zeus Panda	Zeus Panda decrypts strings in the code during the execution process.^[29]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as certutil.

Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Deobfuscate/Decode Files or Information

Procedure Examples

Mitigations

Detection

References