Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Obfuscated Files or Information: Encrypted/Encoded File

Other sub-techniques of Obfuscated Files or Information (14)

ID	Название
.001	Добавление в бинарный файл незначащих данных
.002	Упаковка ПО
.003	Стеганография
.004	Компиляция после доставки
.005	Удаление индикаторов компрометации из вредоносных инструментов
.006	Скрытая передача через HTML
.007	Динамическое разрешение API
.008	Перевод полезных нагрузок в трудночитаемый формат
.009	Встроенные полезные нагрузки
.010	Command Obfuscation
.011	Fileless Storage
.012	LNK Icon Smuggling
.013	Encrypted/Encoded File
.014	Polymorphic Code

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use. This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding/compression schemes such as Base64. The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection. For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution).(Citation: SFX - Encrypted/Encoded File) Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.

ID: T1027.013

Относится к технике: T1027

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Источники данных: File: File Creation, File: File Metadata

Дата создания: 29 Mar 2024

Последнее изменение: 15 Oct 2024

Название	Описание
Примеры процедур
DEADEYE	DEADEYE has encrypted its payload.(Citation: Mandiant APT41)
Torisma	Torisma has been Base64 encoded and AES encrypted.(Citation: McAfee Lazarus Nov 2020)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.(Citation: TrendMicro MacOS April 2018)
Inception	Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.(Citation: Kaspersky Cloud Atlas December 2014)
USBStealer	Most strings in USBStealer are encrypted using 3DES and XOR and reversed.(Citation: ESET Sednit USBStealer 2014)
Emissary	Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.(Citation: Lotus Blossom Dec 2015)(Citation: Emissary Trojan Feb 2016)
Cuckoo Stealer	Cuckoo Stealer strings are XOR-encrypted.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)
Kessel	Kessel's configuration is hardcoded and RC4 encrypted within the binary.(Citation: ESET ForSSHe December 2018)
Raindrop	Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Rifdoor	Rifdoor has encrypted strings with a single byte XOR algorithm.(Citation: Carbon Black HotCroissant April 2020)
Dark Caracal	Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.(Citation: Lookout Dark Caracal Jan 2018)
Elderwood	Elderwood has encrypted documents and malicious executables.(Citation: Symantec Elderwood Sept 2012)
Shark	Shark can use encrypted and encoded files for C2 configuration.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
Ursnif	Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.(Citation: ProofPoint Ursnif Aug 2016) Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.(Citation: Bromium Ursnif Mar 2017)
ROADSWEEP	The ROADSWEEP binary contains RC4 encrypted embedded scripts.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)
Darkhotel	Darkhotel has obfuscated code using RC4, XOR, and RSA.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)
Transparent Tribe	Transparent Tribe has dropped encoded executables on compromised hosts.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Ninja	The Ninja payload is XOR encrypted and compressed.(Citation: Kaspersky ToddyCat Check Logs October 2023) Ninja has also XORed its configuration data with a constant value of `0xAA` and compressed it with the LZSS algorithm.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
APT28	APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)(Citation: Talos Seduploader Oct 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)
HAWKBALL	HAWKBALL has encrypted the payload with an XOR-based algorithm.(Citation: FireEye HAWKBALL Jun 2019)
Skidmap	Skidmap has encrypted it's main payload using 3DES.(Citation: Trend Micro Skidmap)
Astaroth	Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.(Citation: Securelist Brazilian Banking Malware July 2020)
APT18	APT18 obfuscates strings in the payload.(Citation: PaloAlto DNS Requests May 2016)
KEYPLUG	KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.(Citation: Mandiant APT41)
Sakula	Sakula uses single-byte XOR obfuscation to obfuscate many of its files.(Citation: Dell Sakula)
Zox	Zox has been encoded with Base64.(Citation: Novetta-Axiom)
Helminth	The Helminth config file is encrypted with RC4.(Citation: Palo Alto OilRig May 2016)
SamSam	SamSam has been seen using AES or DES to encrypt payloads and payload components.(Citation: Sophos SamSam Apr 2018)(Citation: Talos SamSam Jan 2018)
Prikormka	Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.(Citation: ESET Operation Groundbait)
NanHaiShu	NanHaiShu encodes files in Base64.(Citation: fsecure NanHaiShu July 2016)
DarkWatchman	DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.(Citation: Prevailion DarkWatchman 2021)
metaMain	metaMain's module file has been encrypted via XOR.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Leviathan	Leviathan has obfuscated code using base64 and gzip compression.(Citation: Proofpoint Leviathan Oct 2017)
Bazar	Bazar has used XOR, RSA2, and RC4 encrypted files.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)(Citation: CrowdStrike Wizard Spider October 2020)
LoudMiner	LoudMiner has encrypted DMG files.(Citation: ESET LoudMiner June 2019)
Sidewinder	Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)
BLUELIGHT	BLUELIGHT has a XOR-encoded payload.(Citation: Volexity InkySquid BLUELIGHT August 2021)
PipeMon	PipeMon modules are stored encrypted on disk.(Citation: ESET PipeMon May 2020)
Woody RAT	Woody RAT has used Base64 encoded strings and scripts.(Citation: MalwareBytes WoodyRAT Aug 2022)
Molerats	Molerats has delivered compressed executables within ZIP files to victims.(Citation: Kaspersky MoleRATs April 2019)
DCSrv	DCSrv's configuration is encrypted.(Citation: Checkpoint MosesStaff Nov 2021)
APT39	APT39 has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)
GravityRAT	GravityRAT supports file encryption (AES with the key "lolomycin2017").(Citation: Talos GravityRAT)
Metamorfo	Metamorfo has encrypted payloads and strings.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)
Lazarus Group	Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Saint Bear	Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
APT33	APT33 has used base64 to encode payloads.(Citation: FireEye APT33 Guardrail)
	During Night Dragon, threat actors used a DLL that included an XOR-encoded section.(Citation: McAfee Night Dragon)
LightNeuron	LightNeuron encrypts its configuration files with AES-256.(Citation: ESET LightNeuron May 2019)
DanBot	DanBot can Base64 encode its payload.(Citation: SecureWorks August 2019)
FELIXROOT	FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
Remsec	Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Technical Analysis)
SocGholish	The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile) SocGholish has also single or double Base-64 encoded references to its second-stage server URLs.(Citation: SentinelOne SocGholish Infrastructure November 2022)
DUSTTRAP	DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.(Citation: Google Cloud APT41 2024)
	During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.(Citation: McAfee Honeybee)
WindTail	WindTail can be delivered as a compressed, encrypted, and encoded payload.(Citation: objective-see windtail2 jan 2019)
Grandoreiro	The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.(Citation: Securelist Brazilian Banking Malware July 2020)(Citation: ESET Grandoreiro April 2020)(Citation: ESET Grandoreiro April 2020)
Milan	Milan can encode files containing information about the targeted system.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)
BLINDINGCAN	BLINDINGCAN has obfuscated code using Base64 encoding.(Citation: US-CERT BLINDINGCAN Aug 2020)
KONNI	KONNI is heavily obfuscated and includes encrypted configuration files.(Citation: Malwarebytes Konni Aug 2021)
TINYTYPHON	TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.(Citation: Forcepoint Monsoon)
BITTER	BITTER has used a RAR SFX dropper to deliver malware.(Citation: Forcepoint BITTER Pakistan Oct 2016)
WhisperGate	WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)(Citation: RecordedFuture WhisperGate Jan 2022)
ZxxZ	ZxxZ has been encoded to avoid detection from static analysis tools.(Citation: Cisco Talos Bitter Bangladesh May 2022)
PcShare	PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.(Citation: Bitdefender FunnyDream Campaign November 2020)
DarkGate	DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation.(Citation: Ensilo Darkgate 2018) DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.(Citation: Trellix Darkgate 2023)
Reaver	Reaver encrypts some of its files with XOR.(Citation: Palo Alto Reaver Nov 2017)
BOOSTWRITE	BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.(Citation: FireEye FIN7 Oct 2019)
Fysbis	Fysbis has been encrypted using XOR and RC4.(Citation: Fysbis Dr Web Analysis)
TA505	TA505 has password-protected malicious Word documents.(Citation: Proofpoint TA505 Sep 2017)
Stuxnet	Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
Higaisa	Higaisa used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
BitPaymer	BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.(Citation: Crowdstrike Indrik November 2018)
Kwampirs	Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.(Citation: Symantec Security Center Trojan.Kwampirs)
Remexi	Remexi obfuscates its configuration data with XOR.(Citation: Securelist Remexi Jan 2019)
TYPEFRAME	APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.(Citation: US-CERT TYPEFRAME June 2018)
FoggyWeb	FoggyWeb has been XOR-encoded.(Citation: MSTIC FoggyWeb September 2021)
APT19	APT19 used Base64 to obfuscate payloads.(Citation: FireEye APT19)
StrongPity	StrongPity has used encrypted strings in its dropper component.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Fox Kitten	Fox Kitten has base64 encoded payloads to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
VersaMem	VersaMem encrypted captured credentials with AES then Base64 encoded them before writing to local storage.(Citation: Lumen Versa 2024)
Bisonal	Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)
Raccoon Stealer	Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)
Threat Group-3390	A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)
RedLeaves	A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.(Citation: PWC Cloud Hopper Technical Annex April 2017)
FlawedGrace	FlawedGrace encrypts its C2 configuration files with AES in CBC mode.(Citation: Proofpoint TA505 Jan 2019)
More_eggs	More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.(Citation: ESET EvilNum July 2020)
Elise	Elise encrypts several of its files, including configuration files.(Citation: Lotus Blossom Jun 2015)
Avenger	Avenger has the ability to XOR encrypt files to be sent to C2.(Citation: Trend Micro Tick November 2019)
EnvyScout	EnvyScout can Base64 encode payloads.(Citation: MSTIC Nobelium Toolset May 2021)
Rising Sun	Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.(Citation: McAfee Sharpshooter December 2018)
LunarMail	LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.(Citation: ESET Turla Lunar toolset May 2024)
Mispadu	Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.(Citation: ESET Security Mispadu Facebook Ads 2019) Mispadu also uses encoded configuration files and has encoded payloads using Base64.(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: SCILabs Malteiro 2021)(Citation: SCILabs Malteiro Threat Overlap 2023)
Dacls	Dacls can encrypt its configuration file with AES CBC.(Citation: TrendMicro macOS Dacls May 2020)
njRAT	njRAT has included a base64 encoded executable.(Citation: Trend Micro njRAT 2018)
TA2541	TA2541 has used compressed and char-encoded scripts in operations.(Citation: Cisco Operation Layover September 2021)
IPsec Helper	IPsec Helper contains an embedded XML configuration file with an encrypted list of command and control servers. These are written to an external configuration file during execution.(Citation: SentinelOne Agrius 2021)
DUSTPAN	DUSTPAN decrypts an embedded payload.(Citation: Google Cloud APT41 2024)(Citation: Google Cloud APT41 2022)
PS1	PS1 is distributed as a set of encrypted files and scripts.(Citation: BlackBerry CostaRicto November 2020)
KeyBoy	In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.(Citation: CitizenLab KeyBoy Nov 2016)
RainyDay	RainyDay has downloaded as a XOR-encrypted payload.(Citation: Bitdefender Naikon April 2021)
Sliver	Sliver can encrypt strings at compile time.(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)
Waterbear	Waterbear has used RC4 encrypted shellcode and encrypted functions.(Citation: Trend Micro Waterbear December 2019)
Malteiro	Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.(Citation: SCILabs Malteiro Threat Overlap 2023)
Winnti for Linux	Winnti for Linux can encode its configuration file with single-byte XOR encoding.(Citation: Chronicle Winnti for Linux May 2019)
Magic Hound	Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Seasalt	Seasalt obfuscates configuration data.(Citation: Mandiant APT1 Appendix)
StoneDrill	StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.(Citation: Kaspersky StoneDrill 2017)
IcedID	IcedID has utilzed encrypted binaries and base64 encoded strings.(Citation: Juniper IcedID June 2020)
Blue Mockingbird	Blue Mockingbird has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May 2020)
DEADWOOD	DEADWOOD contains an embedded, AES-encrypted resource named `METADATA` that contains configuration information for follow-on execution.(Citation: SentinelOne Agrius 2021)
Tropic Trooper	Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
SysUpdate	SysUpdate can encrypt and encode its configuration file.(Citation: Trend Micro Iron Tiger April 2021)
Chrommme	Chrommme can encrypt sections of its code to evade detection.(Citation: ESET Gelsemium June 2021)
LunarWeb	The LunarWeb install files have been encrypted with AES-256.(Citation: ESET Turla Lunar toolset May 2024)
Attor	Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.(Citation: ESET Attor Oct 2019)
REvil	REvil has used encrypted strings and configuration files.(Citation: G Data Sodinokibi June 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)
Mofang	Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.(Citation: FOX-IT May 2016 Mofang)
HOMEFRY	Some strings in HOMEFRY are obfuscated with XOR x56.(Citation: FireEye Periscope March 2018)
Smoke Loader	Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.(Citation: Malwarebytes SmokeLoader 2016)(Citation: Talos Smoke Loader July 2018)
Aria-body	Aria-body has used an encrypted configuration file for its loader.(Citation: CheckPoint Naikon May 2020)
Mosquito	Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.(Citation: ESET Turla Mosquito Jan 2018)
CozyCar	The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.(Citation: F-Secure CozyDuke)
YAHOYAH	YAHOYAH encrypts its configuration file using a simple algorithm.(Citation: TrendMicro TropicTrooper 2015)
ThreatNeedle	ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.(Citation: Kaspersky ThreatNeedle Feb 2021)
BADHATCH	BADHATCH can be compressed with the ApLib algorithm.(Citation: BitDefender BADHATCH Mar 2021)
	APT41 DUST used encrypted payloads decrypted and executed in memory.(Citation: Google Cloud APT41 2024)
Whitefly	Whitefly has encrypted the payload used for C2.(Citation: Symantec Whitefly March 2019)
menuPass	menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)
BendyBear	BendyBear has encrypted payloads using RC4 and XOR.(Citation: Unit42 BendyBear Feb 2021)
PyDCrypt	PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.(Citation: Checkpoint MosesStaff Nov 2021)
VERMIN	VERMIN is obfuscated using the obfuscation tool called ConfuserEx.(Citation: Unit 42 VERMIN Jan 2018)
HermeticWiper	HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.(Citation: Symantec Ukraine Wipers February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Qualys Hermetic Wiper March 2022)
Micropsia	Micropsia obfuscates the configuration with a custom Base64 and XOR.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
	During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.(Citation: Cylance Dust Storm)
Kevin	Kevin has Base64-encoded its configuration file.(Citation: Kaspersky Lyceum October 2021)
Moses Staff	Moses Staff has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021)
TeamTNT	TeamTNT has encrypted its binaries via AES and encoded files using Base64.(Citation: Trend Micro TeamTNT)(Citation: Aqua TeamTNT August 2020)
JHUHUGIT	Many strings in JHUHUGIT are obfuscated with a XOR algorithm.(Citation: F-Secure Sofacy 2015)(Citation: ESET Sednit Part 1)(Citation: Talos Seduploader Oct 2017)
GoldMax	GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
Chinoxy	Chinoxy has encrypted its configuration file.(Citation: Bitdefender FunnyDream Campaign November 2020)
DOGCALL	DOGCALL is encrypted using single-byte XOR.(Citation: Unit 42 Nokki Oct 2018)
RCSession	RCSession can compress and obfuscate its strings to evade detection on a compromised host.(Citation: Trend Micro DRBControl February 2020)
Heyoka Backdoor	Heyoka Backdoor can encrypt its payload.(Citation: SentinelOne Aoqin Dragon June 2022)
Metador	Metador has encrypted their payloads.(Citation: SentinelLabs Metador Sept 2022)
FIVEHANDS	The FIVEHANDS payload is encrypted with AES-128.(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)
Zeus Panda	Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)
Squirrelwaffle	Squirrelwaffle has been obfuscated with a XOR-based algorithm.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
HyperBro	HyperBro can be delivered encrypted to a compromised host.(Citation: Trend Micro DRBControl February 2020)
STARWHALE	STARWHALE has been obfuscated with hex-encoded strings.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
HotCroissant	HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.(Citation: Carbon Black HotCroissant April 2020)
Group5	Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.(Citation: Citizen Lab Group5)
	During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)
KGH_SPY	KGH_SPY has used encrypted strings in its installer.(Citation: Cybereason Kimsuky November 2020)
SUPERNOVA	SUPERNOVA contained Base64-encoded strings.(Citation: CISA Supernova Jan 2021)
Carberp	Carberp has used XOR-based encryption to mask C2 server locations within the trojan.(Citation: Prevx Carberp March 2011)
Putter Panda	Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.(Citation: CrowdStrike Putter Panda)
Emotet	Emotet uses obfuscated URLs to download a ZIP file.(Citation: emotet_trendmicro_mar2023)
SpeakUp	SpeakUp encodes its second-stage payload with Base64. (Citation: CheckPoint SpeakUp Feb 2019)
OilRig	OilRig has encrypted and encoded data in its malware, including by using base64.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Playbook 2023)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Unit42 OilRig Nov 2018)
Mafalda	Mafalda has been obfuscated and contains encrypted functions.(Citation: SentinelLabs Metador Sept 2022)
Hi-Zor	Hi-Zor uses various XOR techniques to obfuscate its components.(Citation: Fidelis INOCNATION)
HiddenWasp	HiddenWasp encrypts its configuration and payload.(Citation: Intezer HiddenWasp Map 2019)
Latrodectus	Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
GoldenSpy	GoldenSpy's uninstaller has base64-encoded its variables. (Citation: Trustwave GoldenSpy2 June 2020)
Taidoor	Taidoor can use encrypted string blocks for obfuscation.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
WastedLocker	The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.(Citation: NCC Group WastedLocker June 2020)
	For Operation Spalax, the threat actors used XOR-encrypted payloads.(Citation: ESET Operation Spalax Jan 2021)
Winnti for Windows	Winnti for Windows has the ability to encrypt and compress its payload.(Citation: Novetta Winnti April 2015)
Exaramel for Linux	Exaramel for Linux uses RC4 for encrypting the configuration.(Citation: ESET TeleBots Oct 2018)(Citation: ANSSI Sandworm January 2021)
APT32	APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.(Citation: FireEye APT32 May 2017)(Citation: GitHub Invoke-Obfuscation)(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)
HermeticWizard	HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.(Citation: ESET Hermetic Wizard March 2022)
Gazer	Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.(Citation: Securelist WhiteBear Aug 2017)
	During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.(Citation: Mandiant Cutting Edge Part 2 January 2024)
Hildegard	Hildegard has encrypted an ELF file.(Citation: Unit 42 Hildegard Malware)
Gelsemium	Gelsemium has the ability to compress its components.(Citation: ESET Gelsemium June 2021)
Volgmer	A Volgmer variant is encoded using a simple XOR cipher.(Citation: US-CERT Volgmer 2 Nov 2017)
IronNetInjector	IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.(Citation: Unit 42 IronNetInjector February 2021 )
TrickBot	TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.(Citation: S2 Grupo TrickBot June 2017)
RAPIDPULSE	RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.(Citation: Mandiant Pulse Secure Update May 2021)
Uroburos	Uroburos can use AES and CAST-128 encryption to obfuscate resources.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
FunnyDream	FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.(Citation: Bitdefender FunnyDream Campaign November 2020)
AuditCred	AuditCred encrypts the configuration.(Citation: TrendMicro Lazarus Nov 2018)
Penquin	Penquin has encrypted strings in the binary for obfuscation.(Citation: Leonardo Turla Penquin May 2020)
Moonstone Sleet	Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.(Citation: Microsoft Moonstone Sleet 2024)
GreyEnergy	GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.(Citation: ESET GreyEnergy Oct 2018)
CARROTBAT	CARROTBAT has the ability to download a base64 encoded payload.(Citation: Unit 42 CARROTBAT November 2018)
ZeroT	ZeroT has encrypted its payload with RC4.(Citation: Proofpoint ZeroT Feb 2017)
Cardinal RAT	Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.(Citation: PaloAlto CardinalRat Apr 2017)

Контрмера	Описание
Контрмеры
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Obfuscated Files or Information: Encrypted/Encoded File

Other sub-techniques of Obfuscated Files or Information (14)

Примеры процедур

Контрмеры

Ссылки

Связанные риски

Каталоги