Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Obfuscated Files or Information

Sub-techniques (14)

ID	Name
.001	Binary Padding
.002	Software Packing
.003	Steganography
.004	Compile After Delivery
.005	Indicator Removal from Tools
.006	HTML Smuggling
.007	Dynamic API Resolution
.008	Stripped Payloads
.009	Embedded Payloads
.010	Command Obfuscation
.011	Fileless Storage
.012	LNK Icon Smuggling
.013	Encrypted/Encoded File
.014	Polymorphic Code

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

ID: T1027

Sub-techniques: .001 .002 .003 .004 .005 .006 .007 .008 .009 .010 .011 .012 .013 .014

Tactic(s): Defense Evasion

Platforms: Linux, macOS, Network, Windows

Data Sources: Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Windows Registry: Windows Registry Key Creation, WMI: WMI Creation

Version: 1.6

Created: 31 May 2017

Last Modified: 16 Apr 2024

Name	Description
Procedure Examples
BackdoorDiplomacy	BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy Jun 2021)
Ryuk	Ryuk can use anti-disassembly and code transformation obfuscation techniques.(Citation: CrowdStrike Wizard Spider October 2020)
RedCurl	RedCurl has used malware with string encryption.(Citation: therecord_redcurl) RedCurl has also encrypted data and has encoded PowerShell commands using Base64.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. (Citation: group-ib_redcurl1) Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.(Citation: trendmicro_redcurl)
DarkTortilla	DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.(Citation: Secureworks DarkTortilla Aug 2022)
Machete	Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.(Citation: Cylance Machete Mar 2017)
Operation Wocao	Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.(Citation: FoxIT Wocao December 2019)
Lokibot	Lokibot has obfuscated strings with base64 encoding.(Citation: Infoblox Lokibot January 2019)
SVCReady	SVCReady can encrypt victim data with an RC4 cipher.(Citation: HP SVCReady Jun 2022)
PowerStallion	PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.(Citation: ESET Turla PowerShell May 2019)
SynAck	SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
Amadey	Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.(Citation: BlackBerry Amadey 2020)
PolyglotDuke	PolyglotDuke can custom encrypt strings.(Citation: ESET Dukes October 2019)
CHIMNEYSWEEP	CHIMNEYSWEEP can use a custom Base64 alphabet to encode an API decryption key.(Citation: Mandiant ROADSWEEP August 2022)
PUNCHTRACK	PUNCHTRACK is loaded and executed by a highly obfuscated launcher.(Citation: FireEye Fin8 May 2016)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON has encrypted strings with RC4.(Citation: CISA EB Aug 2020)
Drovorub	Drovorub has used XOR encrypted payloads in WebSocket client to server messages.(Citation: NSA/FBI Drovorub August 2020)
Valak	Valak has the ability to base64 encode and XOR encrypt strings.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)
Rocke	Rocke has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)
PoisonIvy	PoisonIvy hides any strings related to its own indicators of compromise.(Citation: Symantec Darkmoon Aug 2005)
Out1	Out1 has the ability to encode data.(Citation: Trend Micro Muddy Water March 2021)
HTTPBrowser	HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.(Citation: Dell TG-3390)
Trojan.Karagany	Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.(Citation: Secureworks Karagany July 2019)
APT29	APT29 has used encoded PowerShell commands.(Citation: FireEye APT29 Nov 2018)
GALLIUM	GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.(Citation: Cybereason Soft Cell June 2019)
Gallmaker	Gallmaker obfuscated shellcode used during execution.(Citation: Symantec Gallmaker Oct 2018)
Saint Bot	Saint Bot has been obfuscated to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
NanoCore	NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.(Citation: PaloAlto NanoCore Feb 2016)
SHOTPUT	SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.(Citation: FireEye Clandestine Wolf)(Citation: Palo Alto CVE-2015-3113 July 2015)
SodaMaster	SodaMaster can use "stackstrings" for obfuscation.(Citation: Securelist APT10 March 2021)
CoinTicker	CoinTicker initially downloads a hidden encoded file.(Citation: CoinTicker 2019)
Turian	Turian can use VMProtect for obfuscation.(Citation: ESET BackdoorDiplomacy Jun 2021)
Snip3	Snip3 has the ability to obfuscate strings using XOR encryption.(Citation: Morphisec Snip3 May 2021)
ComRAT	ComRAT has encrypted its virtual file system using AES-256 in XTS mode.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
Final1stspy	Final1stspy obfuscates strings with base64 encoding.(Citation: Unit 42 Nokki Oct 2018)
DustySky	The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.(Citation: DustySky)
SUNSPOT	SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion process.(Citation: CrowdStrike SUNSPOT Implant January 2021)
Pillowmint	Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.(Citation: Trustwave Pillowmint June 2020)
Donut	Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.(Citation: Donut Github)
H1N1	H1N1 uses multiple techniques to obfuscate strings, including XOR.(Citation: Cisco H1N1 Part 1)
Kazuar	Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.(Citation: Unit 42 Kazuar May 2017)
NETWIRE	NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.(Citation: FireEye NETWIRE March 2019)
SombRAT	SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
BlackOasis	BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.(Citation: Securelist BlackOasis Oct 2017)
Pony	Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.(Citation: Malwarebytes Pony April 2016)
Agent Tesla	Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.(Citation: Fortinet Agent Tesla April 2018) Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.(Citation: Malwarebytes Agent Tesla April 2020)
TrickBot	TrickBot uses non-descriptive names to hide functionality.(Citation: S2 Grupo TrickBot June 2017)
InnaputRAT	InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.(Citation: ASERT InnaputRAT April 2018)
MiniDuke	MiniDuke can use control flow flattening to obscure code.(Citation: ESET Dukes October 2019)
APT3	APT3 obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)
TEARDROP	TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Check Point Sunburst Teardrop December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)
Matryoshka	Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.(Citation: CopyKittens Nov 2015)
Clambling	The Clambling executable has been obfuscated when dropped on a compromised host.(Citation: Trend Micro DRBControl February 2020)
Brute Ratel C4	Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.(Citation: Palo Alto Brute Ratel July 2022)(Citation: MDSec Brute Ratel August 2022)
Shamoon	Shamoon contains base64-encoded strings.(Citation: Palo Alto Shamoon Nov 2016)
Hydraq	Hydraq uses basic obfuscation in the form of spaghetti code.(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)
QakBot	QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.(Citation: Cyberint Qakbot May 2021)
Ember Bear	Ember Bear has obfuscated malware and malicious scripts to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
DarkGate	DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.(Citation: Trellix Darkgate 2023)
Flagpro	Flagpro has been delivered within ZIP or RAR password-protected archived files.(Citation: NTT Security Flagpro new December 2021)
	During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.(Citation: Mandiant APT41)
Cuba	Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.(Citation: McAfee Cuba April 2021)
Dridex	Dridex's strings are obfuscated using RC4.(Citation: Checkpoint Dridex Jan 2021)
Goopy	Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.(Citation: Cybereason Cobalt Kitty 2017)
Ecipekac	Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.(Citation: Securelist APT10 March 2021)
NOKKI	NOKKI uses Base64 encoding for strings.(Citation: Unit 42 NOKKI Sept 2018)
POSHSPY	POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.(Citation: FireEye POSHSPY April 2017)
SUNBURST	SUNBURST strings were compressed and encoded in Base64.(Citation: Microsoft Analyzing Solorigate Dec 2020) SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.(Citation: FireEye SUNBURST Backdoor December 2020)
Remcos	Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.(Citation: Talos Remcos Aug 2018)
Kerrdown	Kerrdown can encrypt, encode, and compress multiple layers of shellcode.(Citation: Unit 42 KerrDown February 2019)
UNC2452	UNC2452 used encoded PowerShell commands.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)
Frankenstein	Frankenstein has run encoded commands from the command line.(Citation: Talos Frankenstein June 2019)
FatDuke	FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.(Citation: ESET Dukes October 2019)
APT-C-36	APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.(Citation: QiAnXin APT-C-36 Feb2019)
Carbanak	Carbanak encrypts strings to make analysis more difficult.(Citation: FireEye CARBANAK June 2017)
Action RAT	Action RAT's commands, strings, and domains can be Base64 encoded within the payload.(Citation: MalwareBytes SideCopy Dec 2021)
Small Sieve	Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.(Citation: NCSC GCHQ Small Sieve Jan 2022)
Night Dragon	A Night Dragon DLL included an XOR-encoded section.(Citation: McAfee Night Dragon)
	During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.(Citation: ESET Industroyer)
Dust Storm	Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.(Citation: Cylance Dust Storm)
Bundlore	Bundlore has obfuscated data with base64, AES, RC4, and bz2.(Citation: MacKeeper Bundlore Apr 2019)
KillDisk	KillDisk uses VMProtect to make reverse engineering the malware more difficult.(Citation: Trend Micro KillDisk 1)
ROKRAT	ROKRAT can encrypt data prior to exfiltration by using an RSA public key.(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
P.A.S. Webshell	P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.(Citation: ANSSI Sandworm January 2021)
OLDBAIT	OLDBAIT obfuscates internal strings and unpacks them at startup.(Citation: FireEye APT28)
Anchor	Anchor has obfuscated code with stack strings and string encryption.(Citation: Cyberreason Anchor December 2019)
Daserf	Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.(Citation: Trend Micro Daserf Nov 2017)
Pandora	Pandora has the ability to compress stings with QuickLZ.(Citation: Trend Micro Iron Tiger April 2021)
Windshift	Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)
Ke3chang	Ke3chang has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)
Ebury	Ebury has obfuscated its strings with a simple XOR encryption with a static key.(Citation: ESET Ebury Feb 2014)
Conti	Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.(Citation: CarbonBlack Conti July 2020)(Citation: Cybereason Conti Jan 2021)(Citation: CrowdStrike Wizard Spider October 2020)
Kobalos	Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.(Citation: ESET Kobalos Feb 2021)
APT37	APT37 obfuscates strings and payloads.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid RokRAT August 2021)
InvisiMole	InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Bumblebee	Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.(Citation: Proofpoint Bumblebee April 2022)(Citation: Cybereason Bumblebee August 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
ISMInjector	ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.(Citation: OilRig New Delivery Oct 2017)
Kimsuky	Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019) Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.(Citation: Talos Kimsuky Nov 2021)
Dtrack	Dtrack has used a dropper that embeds an encrypted payload as extra data.(Citation: Securelist Dtrack)
Moonstone Sleet	Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.(Citation: Microsoft Moonstone Sleet 2024)
Green Lambert	Green Lambert has encrypted strings.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
	During C0015, the threat actors used Base64-encoded strings.(Citation: DFIR Conti Bazar Nov 2021)
Carbon	Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.(Citation: ESET Carbon Mar 2017)(Citation: Accenture HyperStack October 2020)
Diavol	Diavol has Base64 encoded the RSA public key used for encrypting files.(Citation: Fortinet Diavol July 2021)
MCMD	MCMD can Base64 encode output strings prior to sending to C2.(Citation: Secureworks MCMD July 2019)
ShimRat	ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.(Citation: FOX-IT May 2016 Mofang)
Honeybee	Honeybee drops files with base64-encoded data.(Citation: McAfee Honeybee)
AppleSeed	AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.(Citation: Malwarebytes Kimsuky June 2021)
BoxCaon	BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.(Citation: Checkpoint IndigoZebra July 2021)
ADVSTORESHELL	Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.(Citation: Kaspersky Sofacy)(Citation: Bitdefender APT28 Dec 2015)
Conficker	Conficker has obfuscated its code to prevent its removal from host machines.(Citation: Trend Micro Conficker)
Siloscape	Siloscape itself is obfuscated and uses obfuscated API calls.(Citation: Unit 42 Siloscape Jun 2021)
BPFDoor	BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`.(Citation: Sandfly BPFDoor 2022)
Mustang Panda	Mustang Panda has delivered initial payloads hidden using archives and encoding measures.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 November 2020)(Citation: Proofpoint TA416 Europe March 2022)
ShadowPad	ShadowPad has encrypted its payload, a virtual file system, and various files.(Citation: Securelist ShadowPad Aug 2017)(Citation: TrendMicro EarthLusca 2022)
EKANS	EKANS uses encoded strings in its process kill list.(Citation: FireEye Ransomware Feb 2020)
RegDuke	RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.(Citation: ESET Dukes October 2019)
NightClub	NightClub can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.(Citation: MoustachedBouncer ESET August 2023)
Sandworm Team	Sandworm Team has used Base64 encoding within malware variants.(Citation: iSight Sandworm Oct 2014)
Imminent Monitor	Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.(Citation: QiAnXin APT-C-36 Feb2019)
Earth Lusca	Earth Lusca used Base64 to encode strings.(Citation: TrendMicro EarthLusca 2022)
SoreFang	SoreFang has the ability to encode and RC6 encrypt data sent to C2.(Citation: CISA SoreFang July 2016)
Hancitor	Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)
Pisloader	Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.(Citation: Palo Alto DNS Requests)
Avaddon	Avaddon has used encrypted strings.(Citation: Arxiv Avaddon Feb 2021)
JPIN	A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.(Citation: Microsoft PLATINUM April 2016)
RTM	RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
CARROTBALL	CARROTBALL has used a custom base64 alphabet to decode files.(Citation: Unit 42 CARROTBAT January 2020)
Sardonic	Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.(Citation: Symantec FIN8 Jul 2023)
Raspberry Robin	Raspberry Robin uses mixed-case letters for filenames and commands to evade detection.(Citation: RedCanary RaspberryRobin 2022)
Gamaredon Group	Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.(Citation: ESET Gamaredon June 2020)
AppleJeus	AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.(Citation: CISA AppleJeus Feb 2021)
DRATzarus	DRATzarus can be partly encrypted with XOR.(Citation: ClearSky Lazarus Aug 2020)
AvosLocker	AvosLocker has used XOR-encoded strings.(Citation: Malwarebytes AvosLocker Jul 2021)
PoetRAT	PoetRAT has used a custom encryption scheme for communication between scripts.(Citation: Talos PoetRAT April 2020)
Ramsay	Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.(Citation: Eset Ramsay May 2020)
PUNCHBUGGY	PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.(Citation: Morphisec ShellTea June 2019)
COATHANGER	COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.(Citation: NCSC-NL COATHANGER Feb 2024)
Maze	Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.(Citation: McAfee Maze March 2020)
Gootloader	The Gootloader first stage script is obfuscated using random alpha numeric strings.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)
Epic	Epic heavily obfuscates its code to make analysis more difficult.(Citation: Kaspersky Turla)
CORESHELL	CORESHELL obfuscates strings using a custom stream cipher.(Citation: FireEye APT28)
PlugX	PlugX can use API hashing and modify the names of strings to evade detection.(Citation: Trend Micro DRBControl February 2020)(Citation: Proofpoint TA416 Europe March 2022)
XTunnel	A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.(Citation: ESET Sednit Part 2)
jRAT	jRAT’s Java payload is encrypted with AES.(Citation: jRAT Symantec Aug 2018) Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.(Citation: Symantec Frutas Feb 2013)
OopsIE	OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
GrimAgent	GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.(Citation: Group IB GrimAgent July 2021)
ShimRatReporter	ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.(Citation: FOX-IT May 2016 Mofang)
StreamEx	StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.(Citation: Cylance Shell Crew Feb 2017)
APT41	APT41 used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)
SDBbot	SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.(Citation: Proofpoint TA505 October 2019)
SLOWPULSE	SLOWPULSE can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.(Citation: Mandiant Pulse Secure Zero-Day April 2021)
TajMahal	TajMahal has used an encrypted Virtual File System to store plugins.(Citation: Kaspersky TajMahal April 2019)
Denis	Denis obfuscates its code and encrypts the API names.(Citation: Cybereason Cobalt Kitty 2017)
FinFisher	FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Samurai	Samurai can encrypt the names of requested APIs and deliver its final payload as a compressed, encrypted and base64 encoded blob.(Citation: Kaspersky ToddyCat June 2022)
Orz	Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.(Citation: Proofpoint Leviathan Oct 2017)
BUSHWALK	BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.(Citation: Mandiant Cutting Edge Part 2 January 2024)
BoomBox	BoomBox can encrypt data using AES prior to exfiltration.(Citation: MSTIC Nobelium Toolset May 2021)
Cobalt Strike	Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Industroyer	Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.(Citation: ESET Industroyer)
Comnie	Comnie uses RC4 and Base64 to obfuscate strings.(Citation: Palo Alto Comnie)
TRITON	TRITON encoded the two inject.bin and imain.bin payloads.(Citation: FireEye TRITON 2017)

Mitigation	Description
Mitigations
Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.

Detection

Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). Flag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) Obfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.