MITRE ATT&CK - Техника Обфусцированные файлы или данные

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Обфусцированные файлы или данные

Sub-techniques (9)

ID	Name
.001	Добавление в бинарный файл незначащих данных
.002	Упаковка ПО
.003	Стеганография
.004	Компиляция после доставки
.005	Удаление индикаторов компрометации из вредоносных инструментов
.006	Скрытая передача через HTML
.007	Динамическое разрешение API
.008	Перевод полезных нагрузок в трудночитаемый формат
.009	Встроенные полезные нагрузки

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also obfuscate commands executed from payloads or directly via a Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

ID: T1027

Суб-техники: .001 .002 .003 .004 .005 .006 .007 .008 .009

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation

Версия: 1.3

Дата создания: 31 May 2017

Последнее изменение: 30 Sep 2022

Название	Описание
Примеры процедур
Torisma	Torisma has been Base64 encoded and AES encrypted.(Citation: McAfee Lazarus Nov 2020)
Aquatic Panda	Aquatic Panda has encoded commands in Base64.(Citation: CrowdStrike AQUATIC PANDA December 2021)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.(Citation: TrendMicro MacOS April 2018)
Inception	Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.(Citation: Kaspersky Cloud Atlas December 2014)
USBStealer	Most strings in USBStealer are encrypted using 3DES and XOR and reversed.(Citation: ESET Sednit USBStealer 2014)
Emissary	Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.(Citation: Lotus Blossom Dec 2015)(Citation: Emissary Trojan Feb 2016)
Kessel	Kessel's configuration is hardcoded and RC4 encrypted within the binary.(Citation: ESET ForSSHe December 2018)
BackdoorDiplomacy	BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy Jun 2021)
Raindrop	Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
HEXANE	HEXANE has used Base64-encoded scripts.(Citation: Kaspersky Lyceum October 2021)
Ryuk	Ryuk can use anti-disassembly and code transformation obfuscation techniques.(Citation: CrowdStrike Wizard Spider October 2020)
Rifdoor	Rifdoor has encrypted strings with a single byte XOR algorithm.(Citation: Carbon Black HotCroissant April 2020)
Dark Caracal	Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.(Citation: Lookout Dark Caracal Jan 2018)
Elderwood	Elderwood has encrypted documents and malicious executables.(Citation: Symantec Elderwood Sept 2012)
Machete	Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.(Citation: Cylance Machete Mar 2017)
Operation Wocao	Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.(Citation: FoxIT Wocao December 2019)
Lokibot	Lokibot has obfuscated strings with base64 encoding.(Citation: Infoblox Lokibot January 2019)
Leafminer	Leafminer obfuscated scripts that were used on victim machines.(Citation: Symantec Leafminer July 2018)
Cobalt Group	Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.(Citation: Talos Cobalt Group July 2018)(Citation: Morphisec Cobalt Gang Oct 2018)
Shark	Shark can use encrypted and encoded files for C2 configuration.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
Ursnif	Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.(Citation: ProofPoint Ursnif Aug 2016) Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.(Citation: Bromium Ursnif Mar 2017)
PowerStallion	PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.(Citation: ESET Turla PowerShell May 2019)
Darkhotel	Darkhotel has obfuscated code using RC4, XOR, and RSA.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)
SynAck	SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
Empire	Empire has the ability to obfuscate commands using `Invoke-Obfuscation`.(Citation: Github PowerShell Empire)
Transparent Tribe	Transparent Tribe has dropped encoded executables on compromised hosts.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Amadey	Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.(Citation: BlackBerry Amadey 2020)
IceApple	IceApple can use Base64 and "junk" JavaScript code to obfuscate information.(Citation: CrowdStrike IceApple May 2022)
PolyglotDuke	PolyglotDuke can custom encrypt strings.(Citation: ESET Dukes October 2019)
PowerPunch	PowerPunch can use Base64-encoded scripts.(Citation: Microsoft Actinium February 2022)
APT28	APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)(Citation: Talos Seduploader Oct 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)
PUNCHTRACK	PUNCHTRACK is loaded and executed by a highly obfuscated launcher.(Citation: FireEye Fin8 May 2016)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON has encrypted strings with RC4.(Citation: CISA EB Aug 2020)
Drovorub	Drovorub has used XOR encrypted payloads in WebSocket client to server messages.(Citation: NSA/FBI Drovorub August 2020)
HAWKBALL	HAWKBALL has encrypted the payload with an XOR-based algorithm.(Citation: FireEye HAWKBALL Jun 2019)
Skidmap	Skidmap has encrypted it's main payload using 3DES.(Citation: Trend Micro Skidmap)
Astaroth	Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys.(Citation: Cybereason Astaroth Feb 2019)(Citation: Securelist Brazilian Banking Malware July 2020)
APT18	APT18 obfuscates strings in the payload.(Citation: PaloAlto DNS Requests May 2016)
Valak	Valak has the ability to base64 encode and XOR encrypt strings.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)
Sakula	Sakula uses single-byte XOR obfuscation to obfuscate many of its files.(Citation: Dell Sakula)
Zox	Zox has been encoded with Base64.(Citation: Novetta-Axiom)
Rocke	Rocke has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)
PoisonIvy	PoisonIvy hides any strings related to its own indicators of compromise.(Citation: Symantec Darkmoon Aug 2005)
Helminth	The Helminth config file is encrypted with RC4.(Citation: Palo Alto OilRig May 2016)
Out1	Out1 has the ability to encode data.(Citation: Trend Micro Muddy Water March 2021)
SamSam	SamSam has been seen using AES or DES to encrypt payloads and payload components.(Citation: Sophos SamSam Apr 2018)(Citation: Talos SamSam Jan 2018)
Prikormka	Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.(Citation: ESET Operation Groundbait)
HTTPBrowser	HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.(Citation: Dell TG-3390)
NanHaiShu	NanHaiShu encodes files in Base64.(Citation: fsecure NanHaiShu July 2016)
	During Frankenstein, the threat actors ran encoded commands from the command line.(Citation: Talos Frankenstein June 2019)
DarkWatchman	DarkWatchman has used Base64 to encode PowerShell commands. DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.(Citation: Prevailion DarkWatchman 2021)
Trojan.Karagany	Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.(Citation: Secureworks Karagany July 2019)
APT29	APT29 has used encoded PowerShell commands.(Citation: FireEye APT29 Nov 2018)
GALLIUM	GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.(Citation: Cybereason Soft Cell June 2019)
Leviathan	Leviathan has obfuscated code using base64 and gzip compression.(Citation: Proofpoint Leviathan Oct 2017)
FIN6	FIN6 has used encoded PowerShell commands.(Citation: Visa FIN6 Feb 2019)
Bazar	Bazar has used XOR, RSA2, and RC4 encrypted files.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)(Citation: CrowdStrike Wizard Spider October 2020)
Gallmaker	Gallmaker obfuscated shellcode used during execution.(Citation: Symantec Gallmaker Oct 2018)
Saint Bot	Saint Bot has been obfuscated to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
NanoCore	NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.(Citation: PaloAlto NanoCore Feb 2016)
LoudMiner	LoudMiner has obfuscated various scripts and encrypted DMG files.(Citation: ESET LoudMiner June 2019)
SHOTPUT	SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.(Citation: FireEye Clandestine Wolf)(Citation: Palo Alto CVE-2015-3113 July 2015)
SodaMaster	SodaMaster can use "stackstrings" for obfuscation.(Citation: Securelist APT10 March 2021)
Sidewinder	Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)
CoinTicker	CoinTicker initially downloads a hidden encoded file.(Citation: CoinTicker 2019)
BLUELIGHT	BLUELIGHT has a XOR-encoded payload.(Citation: Volexity InkySquid BLUELIGHT August 2021)
PipeMon	PipeMon modules are stored encrypted on disk.(Citation: ESET PipeMon May 2020)
Molerats	Molerats has delivered compressed executables within ZIP files to victims.(Citation: Kaspersky MoleRATs April 2019)
DCSrv	DCSrv's configuration is encrypted.(Citation: Checkpoint MosesStaff Nov 2021)
Turian	Turian can use VMProtect for obfuscation.(Citation: ESET BackdoorDiplomacy Jun 2021)
APT39	APT39 has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)
GravityRAT	GravityRAT supports file encryption (AES with the key "lolomycin2017").(Citation: Talos GravityRAT)
Metamorfo	Metamorfo has encrypted payloads and strings.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)
ComRAT	ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
Lazarus Group	Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: TrendMicro macOS Dacls May 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)(Citation: ClearSky Lazarus Aug 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Final1stspy	Final1stspy obfuscates strings with base64 encoding.(Citation: Unit 42 Nokki Oct 2018)
APT33	APT33 has used base64 to encode payloads.(Citation: FireEye APT33 Guardrail)
DustySky	The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.(Citation: DustySky)
SUNSPOT	SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion process.(Citation: CrowdStrike SUNSPOT Implant January 2021)
	During Night Dragon, threat actors used a DLL that included an XOR-encoded section.(Citation: McAfee Night Dragon)
LightNeuron	LightNeuron encrypts its configuration files with AES-256.(Citation: ESET LightNeuron May 2019)
Pillowmint	Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.(Citation: Trustwave Pillowmint June 2020)
DanBot	DanBot can Base64 encode its payload.(Citation: SecureWorks August 2019)
FELIXROOT	FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
Remsec	Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Technical Analysis)
Donut	Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.(Citation: Donut Github)
H1N1	H1N1 uses multiple techniques to obfuscate strings, including XOR.(Citation: Cisco H1N1 Part 1)
	During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.(Citation: McAfee Honeybee)
Sibot	Sibot has obfuscated scripts used in execution.(Citation: MSTIC NOBELIUM Mar 2021)
WindTail	WindTail can be delivered as a compressed, encrypted, and encoded payload.(Citation: objective-see windtail2 jan 2019)
Kazuar	Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.(Citation: Unit 42 Kazuar May 2017)
Grandoreiro	The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.(Citation: Securelist Brazilian Banking Malware July 2020)(Citation: ESET Grandoreiro April 2020)(Citation: ESET Grandoreiro April 2020)
Milan	Milan can encode files containing information about the targeted system.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)
BLINDINGCAN	BLINDINGCAN has obfuscated code using Base64 encoding.(Citation: US-CERT BLINDINGCAN Aug 2020)
KONNI	KONNI is heavily obfuscated and includes encrypted configuration files.(Citation: Malwarebytes Konni Aug 2021)
NETWIRE	NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.(Citation: FireEye NETWIRE March 2019)
SombRAT	SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
BlackOasis	BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.(Citation: Securelist BlackOasis Oct 2017)
TINYTYPHON	TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.(Citation: Forcepoint Monsoon)
Pony	Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.(Citation: Malwarebytes Pony April 2016)
BITTER	BITTER has used a RAR SFX dropper to deliver malware.(Citation: Forcepoint BITTER Pakistan Oct 2016)
WhisperGate	WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
Agent Tesla	Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.(Citation: Fortinet Agent Tesla April 2018) Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.(Citation: Malwarebytes Agent Tesla April 2020)
PowerSploit	PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
ZxxZ	ZxxZ has been encoded to avoid detection from static analysis tools.(Citation: Cisco Talos Bitter Bangladesh May 2022)
PcShare	PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.(Citation: Bitdefender FunnyDream Campaign November 2020)
TrickBot	TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.(Citation: S2 Grupo TrickBot June 2017)
Reaver	Reaver encrypts some of its files with XOR.(Citation: Palo Alto Reaver Nov 2017)
BOOSTWRITE	BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.(Citation: FireEye FIN7 Oct 2019)
Fysbis	Fysbis has been encrypted using XOR and RC4.(Citation: Fysbis Dr Web Analysis)
TA505	TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.(Citation: Proofpoint TA505 Sep 2017)(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)
Stuxnet	Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.(Citation: Symantec W.32 Stuxnet Dossier)
Higaisa	Higaisa used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
InnaputRAT	InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.(Citation: ASERT InnaputRAT April 2018)
BitPaymer	BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.(Citation: Crowdstrike Indrik November 2018)
Kwampirs	Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.(Citation: Symantec Security Center Trojan.Kwampirs)
Remexi	Remexi obfuscates its configuration data with XOR.(Citation: Securelist Remexi Jan 2019)
MiniDuke	MiniDuke can use control flow flattening to obscure code.(Citation: ESET Dukes October 2019)
APT3	APT3 obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)
TEARDROP	TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Check Point Sunburst Teardrop December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)
Matryoshka	Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.(Citation: CopyKittens Nov 2015)
TYPEFRAME	APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.(Citation: US-CERT TYPEFRAME June 2018)
Clambling	The Clambling executable has been obfuscated when dropped on a compromised host.(Citation: Trend Micro DRBControl February 2020)
FoggyWeb	FoggyWeb has been XOR-encoded.(Citation: MSTIC FoggyWeb September 2021)
APT19	APT19 used Base64 to obfuscate commands and the payload.(Citation: FireEye APT19)
Shamoon	Shamoon contains base64-encoded strings.(Citation: Palo Alto Shamoon Nov 2016)
Wizard Spider	Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: DFIR Ryuk's Return October 2020)
StrongPity	StrongPity has used encrypted strings in its dropper component.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
MuddyWater	MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: GitHub Invoke-Obfuscation) The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)
Patchwork	Patchwork has obfuscated a script with Crypto Obfuscator.(Citation: TrendMicro Patchwork Dec 2017)
Hydraq	Hydraq uses basic obfuscation in the form of spaghetti code.(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)
Fox Kitten	Fox Kitten has base64 encoded scripts and payloads to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
QakBot	QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.(Citation: Cyberint Qakbot May 2021)
Ember Bear	Ember Bear has obfuscated malware and malicious scripts to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Bisonal	Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)
Threat Group-3390	A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)
RedLeaves	A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Flagpro	Flagpro has been delivered within ZIP or RAR password-protected archived files.(Citation: NTT Security Flagpro new December 2021)
Cuba	Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.(Citation: McAfee Cuba April 2021)
FlawedGrace	FlawedGrace encrypts its C2 configuration files with AES in CBC mode.(Citation: Proofpoint TA505 Jan 2019)
More_eggs	More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.(Citation: ESET EvilNum July 2020)
Elise	Elise encrypts several of its files, including configuration files.(Citation: Lotus Blossom Jun 2015)
Avenger	Avenger has the ability to XOR encrypt files to be sent to C2.(Citation: Trend Micro Tick November 2019)
EnvyScout	EnvyScout can Base64 encode payloads.(Citation: MSTIC Nobelium Toolset May 2021)
Dridex	Dridex's strings are obfuscated using RC4.(Citation: Checkpoint Dridex Jan 2021)
Rising Sun	Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.(Citation: McAfee Sharpshooter December 2018)
Goopy	Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.(Citation: Cybereason Cobalt Kitty 2017)
Ecipekac	Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.(Citation: Securelist APT10 March 2021)
NOKKI	NOKKI uses Base64 encoding for strings.(Citation: Unit 42 NOKKI Sept 2018)
POSHSPY	POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.(Citation: FireEye POSHSPY April 2017)
Dacls	Dacls can encrypt its configuration file with AES CBC.(Citation: TrendMicro macOS Dacls May 2020)
SUNBURST	SUNBURST strings were compressed and encoded in Base64.(Citation: Microsoft Analyzing Solorigate Dec 2020) SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.(Citation: FireEye SUNBURST Backdoor December 2020)
Remcos	Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.(Citation: Talos Remcos Aug 2018)
njRAT	njRAT has included a base64 encoded executable.(Citation: Trend Micro njRAT 2018)
Kerrdown	Kerrdown can encrypt, encode, and compress multiple layers of shellcode.(Citation: Unit 42 KerrDown February 2019)
UNC2452	UNC2452 used encoded PowerShell commands.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)
	During Operation CuckooBees, the threat actors executed an encoded VBScript file.(Citation: Cybereason OperationCuckooBees May 2022)
Frankenstein	Frankenstein has run encoded commands from the command line.(Citation: Talos Frankenstein June 2019)
Chimera	Chimera has encoded PowerShell commands.(Citation: Cycraft Chimera April 2020)
PS1	PS1 is distributed as a set of encrypted files and scripts.(Citation: BlackBerry CostaRicto November 2020)
KeyBoy	In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.(Citation: CitizenLab KeyBoy Nov 2016)
RainyDay	RainyDay has downloaded as a XOR-encrypted payload.(Citation: Bitdefender Naikon April 2021)
Sliver	Sliver can encrypt strings at compile time.(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)
FatDuke	FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.(Citation: ESET Dukes October 2019)
Silence	Silence has used environment variable string substitution for obfuscation.(Citation: Cyber Forensicator Silence Jan 2019)
APT-C-36	APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.(Citation: QiAnXin APT-C-36 Feb2019)
QUADAGENT	QUADAGENT was likely obfuscated using Invoke-Obfuscation.(Citation: Unit 42 QUADAGENT July 2018)(Citation: GitHub Invoke-Obfuscation)
Waterbear	Waterbear has used RC4 encrypted shellcode and encrypted functions.(Citation: Trend Micro Waterbear December 2019)
Carbanak	Carbanak encrypts strings to make analysis more difficult.(Citation: FireEye CARBANAK June 2017)
Action RAT	Action RAT's commands, strings, and domains can be Base64 encoded within the payload.(Citation: MalwareBytes SideCopy Dec 2021)
Winnti for Linux	Winnti for Linux can encode its configuration file with single-byte XOR encoding.(Citation: Chronicle Winnti for Linux May 2019)
Small Sieve	Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.(Citation: NCSC GCHQ Small Sieve Jan 2022)
Night Dragon	A Night Dragon DLL included an XOR-encoded section.(Citation: McAfee Night Dragon)
Magic Hound	Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.(Citation: Unit 42 Magic Hound Feb 2017)
RogueRobin	The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.(Citation: Unit 42 DarkHydrus July 2018)(Citation: GitHub Invoke-Obfuscation)
Seasalt	Seasalt obfuscates configuration data.(Citation: Mandiant APT1 Appendix)
FIN8	FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)
StoneDrill	StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.(Citation: Kaspersky StoneDrill 2017)
IcedID	IcedID has utilzed encrypted binaries and base64 encoded strings.(Citation: Juniper IcedID June 2020)
Blue Mockingbird	Blue Mockingbird has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May 2020)
Tropic Trooper	Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
Dust Storm	Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.(Citation: Cylance Dust Storm)
SysUpdate	SysUpdate can encrypt and encode its configuration file.(Citation: Trend Micro Iron Tiger April 2021)
Chrommme	Chrommme can encrypt sections of its code to evade detection.(Citation: ESET Gelsemium June 2021)
Netwalker	Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables. Netwalker's DLL has also been embedded within the PowerShell script in hex format.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)
Bundlore	Bundlore has obfuscated data with base64, AES, RC4, and bz2.(Citation: MacKeeper Bundlore Apr 2019)
KillDisk	KillDisk uses VMProtect to make reverse engineering the malware more difficult.(Citation: Trend Micro KillDisk 1)
Attor	Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.(Citation: ESET Attor Oct 2019)
ROKRAT	ROKRAT can encrypt data prior to exfiltration by using an RSA public key.(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
REvil	REvil has used encrypted strings and configuration files.(Citation: G Data Sodinokibi June 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)
Mofang	Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.(Citation: FOX-IT May 2016 Mofang)
P.A.S. Webshell	P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.(Citation: ANSSI Sandworm January 2021)
HOMEFRY	Some strings in HOMEFRY are obfuscated with XOR x56.(Citation: FireEye Periscope March 2018)
Smoke Loader	Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.(Citation: Malwarebytes SmokeLoader 2016)(Citation: Talos Smoke Loader July 2018)
OLDBAIT	OLDBAIT obfuscates internal strings and unpacks them at startup.(Citation: FireEye APT28)
Aria-body	Aria-body has used an encrypted configuration file for its loader.(Citation: CheckPoint Naikon May 2020)
Mosquito	Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.(Citation: ESET Turla Mosquito Jan 2018)
CozyCar	The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.(Citation: F-Secure CozyDuke)
Anchor	Anchor has obfuscated code with stack strings and string encryption.(Citation: Cyberreason Anchor December 2019)
Daserf	Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.(Citation: Trend Micro Daserf Nov 2017)
YAHOYAH	YAHOYAH encrypts its configuration file using a simple algorithm.(Citation: TrendMicro TropicTrooper 2015)
ThreatNeedle	ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.(Citation: Kaspersky ThreatNeedle Feb 2021)
Pandora	Pandora has the ability to compress stings with QuickLZ.(Citation: Trend Micro Iron Tiger April 2021)
Whitefly	Whitefly has encrypted the payload used for C2.(Citation: Symantec Whitefly March 2019)
FIN7	FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)
Windshift	Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)
menuPass	menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)
Ke3chang	Ke3chang has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)
Ebury	Ebury has obfuscated its strings with a simple XOR encryption with a static key.(Citation: ESET Ebury Feb 2014)
TA551	TA551 has used obfuscated variable names in a JavaScript configuration file.(Citation: Unit 42 Valak July 2020)
Conti	Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.(Citation: CarbonBlack Conti July 2020)(Citation: Cybereason Conti Jan 2021)(Citation: CrowdStrike Wizard Spider October 2020)
BendyBear	BendyBear has encrypted payloads using RC4 and XOR.(Citation: Unit42 BendyBear Feb 2021)
Kobalos	Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.(Citation: ESET Kobalos Feb 2021)
APT37	APT37 obfuscates strings and payloads.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid RokRAT August 2021)
InvisiMole	InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Emotet	Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts. (Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: Picus Emotet Dec 2018)(Citation: ESET Emotet Dec 2018)
PyDCrypt	PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.(Citation: Checkpoint MosesStaff Nov 2021)
Bumblebee	Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.(Citation: Proofpoint Bumblebee April 2022)(Citation: Cybereason Bumblebee August 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
ISMInjector	ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.(Citation: OilRig New Delivery Oct 2017)
VERMIN	VERMIN is obfuscated using the obfuscation tool called ConfuserEx.(Citation: Unit 42 VERMIN Jan 2018)
Kimsuky	Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019) Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.(Citation: Talos Kimsuky Nov 2021)
HermeticWiper	HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.(Citation: Symantec Ukraine Wipers February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Qualys Hermetic Wiper March 2022)
Micropsia	Micropsia obfuscates the configuration with a custom Base64 and XOR.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
	During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.(Citation: Cylance Dust Storm)
Dtrack	Dtrack has used a dropper that embeds an encrypted payload as extra data.(Citation: Securelist Dtrack)
Kevin	Kevin has Base64-encoded its configuration file.(Citation: Kaspersky Lyceum October 2021)
Moses Staff	Moses Staff has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021)
TeamTNT	TeamTNT has encrypted its binaries via AES and encoded files using Base64.(Citation: Trend Micro TeamTNT)(Citation: Aqua TeamTNT August 2020)
Green Lambert	Green Lambert has encrypted strings.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
FruitFly	FruitFly executes and stores obfuscated Perl scripts.(Citation: objsee mac malware 2017)
	During C0015, the threat actors used Base64-encoded strings.(Citation: DFIR Conti Bazar Nov 2021)
Carbon	Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.(Citation: ESET Carbon Mar 2017)(Citation: Accenture HyperStack October 2020)
Diavol	Diavol has Base64 encoded the RSA public key used for encrypting files.(Citation: Fortinet Diavol July 2021)
JHUHUGIT	Many strings in JHUHUGIT are obfuscated with a XOR algorithm.(Citation: F-Secure Sofacy 2015)(Citation: ESET Sednit Part 1)(Citation: Talos Seduploader Oct 2017)
Turla	Turla has used encryption (including salted 3DES via PowerSploit's `Out-EncryptedScript.ps1`), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.(Citation: ESET Turla PowerShell May 2019)
GoldMax	GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
MCMD	MCMD can Base64 encode output strings prior to sending to C2.(Citation: Secureworks MCMD July 2019)
Chinoxy	Chinoxy has encrypted its configuration file.(Citation: Bitdefender FunnyDream Campaign November 2020)
ShimRat	ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.(Citation: FOX-IT May 2016 Mofang)
DOGCALL	DOGCALL is encrypted using single-byte XOR.(Citation: Unit 42 Nokki Oct 2018)
SQLRat	SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.(Citation: Flashpoint FIN 7 March 2019)
Honeybee	Honeybee drops files with base64-encoded data.(Citation: McAfee Honeybee)
RCSession	RCSession can compress and obfuscate its strings to evade detection on a compromised host.(Citation: Trend Micro DRBControl February 2020)
AppleSeed	AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.(Citation: Malwarebytes Kimsuky June 2021)
Heyoka Backdoor	Heyoka Backdoor can encrypt its payload.(Citation: SentinelOne Aoqin Dragon June 2022)
SHARPSTATS	SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.(Citation: TrendMicro POWERSTATS V3 June 2019)
BoxCaon	BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.(Citation: Checkpoint IndigoZebra July 2021)
ADVSTORESHELL	Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.(Citation: Kaspersky Sofacy)(Citation: Bitdefender APT28 Dec 2015)
BackConfig	BackConfig has used compressed and decimal encoded VBS scripts.(Citation: Unit 42 BackConfig May 2020)
Conficker	Conficker has obfuscated its code to prevent its removal from host machines.(Citation: Trend Micro Conficker)
GOLD SOUTHFIELD	GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.(Citation: Tetra Defense Sodinokibi March 2020)
FIVEHANDS	The FIVEHANDS payload is encrypted with AES-128.(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)
POWERSTATS	POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. (Citation: FireEye MuddyWater Mar 2018)(Citation: ClearSky MuddyWater Nov 2018) POWERSTATS has used PowerShell code with custom string obfuscation (Citation: TrendMicro POWERSTATS V3 June 2019)
Siloscape	Siloscape itself is obfuscated and uses obfuscated API calls.(Citation: Unit 42 Siloscape Jun 2021)
Zeus Panda	Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
Squirrelwaffle	Squirrelwaffle has been obfuscated with a XOR-based algorithm.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
HyperBro	HyperBro can be delivered encrypted to a compromised host.(Citation: Trend Micro DRBControl February 2020)
STARWHALE	STARWHALE has been obfuscated with hex-encoded strings.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Mustang Panda	Mustang Panda has delivered initial payloads hidden using archives and encoding measures.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 November 2020)(Citation: Proofpoint TA416 Europe March 2022)
ShadowPad	ShadowPad has encrypted its payload, a virtual file system, and various files.(Citation: Securelist ShadowPad Aug 2017)(Citation: TrendMicro EarthLusca 2022)
	During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.(Citation: FoxIT Wocao December 2019)
HotCroissant	HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.(Citation: Carbon Black HotCroissant April 2020)
EKANS	EKANS uses encoded strings in its process kill list.(Citation: FireEye Ransomware Feb 2020)
LazyScripter	LazyScripter has leveraged the BatchEncryption tool to perform advanced batch obfuscation and encoding techniques.(Citation: MalwareBytes LazyScripter Feb 2021)
RegDuke	RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.(Citation: ESET Dukes October 2019)
Sandworm Team	Sandworm Team has used Base64 encoding within malware variants. Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.(Citation: iSight Sandworm Oct 2014)(Citation: ESET Telebots Dec 2016)
Group5	Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.(Citation: Citizen Lab Group5)
Imminent Monitor	Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.(Citation: QiAnXin APT-C-36 Feb2019)
KGH_SPY	KGH_SPY has used encrypted strings in its installer.(Citation: Cybereason Kimsuky November 2020)
SUPERNOVA	SUPERNOVA contained Base64-encoded strings.(Citation: CISA Supernova Jan 2021)
Earth Lusca	Earth Lusca used Base64 to encode strings.(Citation: TrendMicro EarthLusca 2022)
SoreFang	SoreFang has the ability to encode and RC6 encrypt data sent to C2.(Citation: CISA SoreFang July 2016)
Carberp	Carberp has used XOR-based encryption to mask C2 server locations within the trojan.(Citation: Prevx Carberp March 2011)
Hancitor	Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)
Putter Panda	Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.(Citation: CrowdStrike Putter Panda)
SpeakUp	SpeakUp encodes its second-stage payload with Base64. (Citation: CheckPoint SpeakUp Feb 2019)
Pisloader	Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.(Citation: Palo Alto DNS Requests)
Avaddon	Avaddon has used encrypted strings.(Citation: Arxiv Avaddon Feb 2021)
OilRig	OilRig has encrypted and encoded data in its malware, including by using base64.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit 42 Playbook Dec 2017)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Unit42 OilRig Nov 2018)
Hi-Zor	Hi-Zor uses various XOR techniques to obfuscate its components.(Citation: Fidelis INOCNATION)
HiddenWasp	HiddenWasp encrypts its configuration and payload.(Citation: Intezer HiddenWasp Map 2019)
JPIN	A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.(Citation: Microsoft PLATINUM April 2016)
CookieMiner	CookieMiner has used base64 encoding to obfuscate scripts on the system.(Citation: Unit42 CookieMiner Jan 2019)
GoldenSpy	GoldenSpy's uninstaller has base64-encoded its variables. (Citation: Trustwave GoldenSpy2 June 2020)
KOCTOPUS	KOCTOPUS has obfuscated scripts with the BatchEncryption tool.(Citation: MalwareBytes LazyScripter Feb 2021)
Taidoor	Taidoor can use encrypted string blocks for obfuscation.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
RTM	RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
WastedLocker	The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.(Citation: NCC Group WastedLocker June 2020)
	For Operation Spalax, the threat actors used XOR-encrypted payloads.(Citation: ESET Operation Spalax Jan 2021)
Winnti for Windows	Winnti for Windows has the ability to encrypt and compress its payload.(Citation: Novetta Winnti April 2015)
CARROTBALL	CARROTBALL has used a custom base64 alphabet to decode files.(Citation: Unit 42 CARROTBAT January 2020)
Exaramel for Linux	Exaramel for Linux uses RC4 for encrypting the configuration.(Citation: ESET TeleBots Oct 2018)(Citation: ANSSI Sandworm January 2021)
APT32	APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation. APT32 has also encoded payloads using Base64 and a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.(Citation: FireEye APT32 May 2017)(Citation: GitHub Invoke-Obfuscation)(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)
HermeticWizard	HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.(Citation: ESET Hermetic Wizard March 2022)
Gamaredon Group	Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)
AppleJeus	AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.(Citation: CISA AppleJeus Feb 2021)
Gazer	Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.(Citation: Securelist WhiteBear Aug 2017)
DRATzarus	DRATzarus can be partly encrypted with XOR.(Citation: ClearSky Lazarus Aug 2020)
Hildegard	Hildegard has encrypted an ELF file.(Citation: Unit 42 Hildegard Malware)
PoetRAT	PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts.(Citation: Talos PoetRAT April 2020)(Citation: Talos PoetRAT October 2020)
Ramsay	Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.(Citation: Eset Ramsay May 2020)
PUNCHBUGGY	PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.(Citation: Morphisec ShellTea June 2019)
Maze	Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.(Citation: McAfee Maze March 2020)
Gelsemium	Gelsemium has the ability to compress its components.(Citation: ESET Gelsemium June 2021)
Volgmer	A Volgmer variant is encoded using a simple XOR cipher.(Citation: US-CERT Volgmer 2 Nov 2017)
Epic	Epic heavily obfuscates its code to make analysis more difficult.(Citation: Kaspersky Turla)
CORESHELL	CORESHELL obfuscates strings using a custom stream cipher.(Citation: FireEye APT28)
PlugX	PlugX can use API hashing and modify the names of strings to evade detection.(Citation: Trend Micro DRBControl February 2020)(Citation: Proofpoint TA416 Europe March 2022)
IronNetInjector	IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.(Citation: Unit 42 IronNetInjector February 2021 )
XTunnel	A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.(Citation: ESET Sednit Part 2)
UBoatRAT	UBoatRAT encrypts instructions in the payload using a simple XOR cipher.(Citation: PaloAlto UBoatRAT Nov 2017)
jRAT	jRAT’s Java payload is encrypted with AES.(Citation: jRAT Symantec Aug 2018) Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.(Citation: Symantec Frutas Feb 2013)
OopsIE	OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
GrimAgent	GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.(Citation: Group IB GrimAgent July 2021)
ShimRatReporter	ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.(Citation: FOX-IT May 2016 Mofang)
StreamEx	StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.(Citation: Cylance Shell Crew Feb 2017)
FunnyDream	FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.(Citation: Bitdefender FunnyDream Campaign November 2020)
APT41	APT41 used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)
SDBbot	SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.(Citation: Proofpoint TA505 October 2019)
TajMahal	TajMahal has used an encrypted Virtual File System to store plugins.(Citation: Kaspersky TajMahal April 2019)
Denis	Denis obfuscates its code and encrypts the API names. Denis also encodes its payload in Base64.(Citation: Securelist Denis April 2017)(Citation: Cybereason Cobalt Kitty 2017)
FinFisher	FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
AuditCred	AuditCred encrypts the configuration.(Citation: TrendMicro Lazarus Nov 2018)
Penquin	Penquin has encrypted strings in the binary for obfuscation.(Citation: Leonardo Turla Penquin May 2020)
Orz	Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.(Citation: Proofpoint Leviathan Oct 2017)
GreyEnergy	GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.(Citation: ESET GreyEnergy Oct 2018)
CARROTBAT	CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.(Citation: Unit 42 CARROTBAT November 2018)
BoomBox	BoomBox can encrypt data using AES prior to exfiltration.(Citation: MSTIC Nobelium Toolset May 2021)
Machete	Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.(Citation: Cylance Machete Mar 2017)(Citation: ESET Machete July 2019)
Cobalt Strike	Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Industroyer	Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.(Citation: ESET Industroyer)
ZeroT	ZeroT has encrypted its payload with RC4.(Citation: Proofpoint ZeroT Feb 2017)
Comnie	Comnie uses RC4 and Base64 to obfuscate strings.(Citation: Palo Alto Comnie)
Cardinal RAT	Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.(Citation: PaloAlto CardinalRat Apr 2017)
TRITON	TRITON encoded the two inject.bin and imain.bin payloads.(Citation: FireEye TRITON 2017)

Контрмера	Описание
Контрмеры
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.

Обнаружение

Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). Flag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) Obfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.