MITRE ATT&CK - Техника Деобфускация/декодирование файлов или информации

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Деобфускация/декодирование файлов или информации

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)

ID: T1140

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Источники данных: File: File Modification, Process: Process Creation, Script: Script Execution

Версия: 1.1

Дата создания: 14 Dec 2017

Последнее изменение: 05 May 2022

Название	Описание
Примеры процедур
ZeroT	ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.(Citation: Proofpoint ZeroT Feb 2017)
AppleJeus	AppleJeus has decoded files received from a C2.(Citation: CISA AppleJeus Feb 2021)
Action RAT	Action RAT can use Base64 to decode actor-controlled C2 server communications.(Citation: MalwareBytes SideCopy Dec 2021)
BRONZE BUTLER	BRONZE BUTLER downloads encoded payloads and decodes them on the victim.(Citation: Secureworks BRONZE BUTLER Oct 2017)
KOCTOPUS	KOCTOPUS has deobfuscated itself before executing its commands.(Citation: MalwareBytes LazyScripter Feb 2021)
BendyBear	BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.(Citation: Unit42 BendyBear Feb 2021)
LiteDuke	LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.(Citation: ESET Dukes October 2019)
P.A.S. Webshell	P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.(Citation: ANSSI Sandworm January 2021)
KONNI	KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
Turla	Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)
Machete	Machete’s downloaded data is decrypted using AES.(Citation: ESET Machete July 2019)
BOOSTWRITE	BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.(Citation: FireEye FIN7 Oct 2019)
APT39	APT39 has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)
More_eggs	More_eggs will decode malware components that are then dropped to the system.(Citation: Security Intelligence More Eggs Aug 2019)
UNC2452	UNC2452 used 7-Zip to decode its Raindrop malware.(Citation: Symantec RAINDROP January 2021)
Gelsemium	Gelsemium can decompress and decrypt DLLs and shellcode.(Citation: ESET Gelsemium June 2021)
Smoke Loader	Smoke Loader deobfuscates its code.(Citation: Talos Smoke Loader July 2018)
Clop	Clop has used a simple XOR operation to decrypt strings.(Citation: Mcafee Clop Aug 2019)
SDBbot	SDBbot has the ability to decrypt and decompress its payload to enable code execution.(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)
Babuk	Babuk has the ability to unpack itself into memory using XOR.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: Medium Babuk February 2021)
BBSRAT	BBSRAT uses Expand to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)
SysUpdate	SysUpdate can deobfuscate packed binaries in memory.(Citation: Trend Micro Iron Tiger April 2021)
Lokibot	Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.(Citation: Talos Lokibot Jan 2021)
POWERSTATS	POWERSTATS can deobfuscate the main backdoor code.(Citation: ClearSky MuddyWater Nov 2018)
QUADAGENT	QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.(Citation: Unit 42 QUADAGENT July 2018)
WIRTE	WIRTE has used Base64 to decode malicious VBS script.(Citation: Lab52 WIRTE Apr 2019)
VaporRage	VaporRage can deobfuscate XOR-encoded shellcode prior to execution.(Citation: MSTIC Nobelium Toolset May 2021)
APT29	APT29 used 7-Zip to decode its Raindrop malware.(Citation: Symantec RAINDROP January 2021)
Gorgon Group	Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.(Citation: Unit 42 Gorgon Group Aug 2018)
Kimsuky	Kimsuky has decoded malicious VBScripts using Base64.(Citation: Talos Kimsuky Nov 2021)
Lucifer	Lucifer can decrypt its C2 address upon execution.(Citation: Unit 42 Lucifer June 2020)
Avaddon	Avaddon has decrypted encrypted strings.(Citation: Arxiv Avaddon Feb 2021)
SombRAT	SombRAT can run `upload` to decrypt and upload files from storage.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Mongall	Mongall has the ability to decrypt its payload prior to execution.(Citation: SentinelOne Aoqin Dragon June 2022)
FoggyWeb	FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.(Citation: MSTIC FoggyWeb September 2021)
Imminent Monitor	Imminent Monitor has decoded malware components that are then dropped to the system.(Citation: QiAnXin APT-C-36 Feb2019)
	For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.(Citation: ESET Operation Spalax Jan 2021)
Aria-body	Aria-body has the ability to decrypt the loader configuration and payload DLL.(Citation: CheckPoint Naikon May 2020)
ShadowPad	ShadowPad has decrypted a binary blob to start execution.(Citation: Kaspersky ShadowPad Aug 2017)
Starloader	Starloader decrypts and executes shellcode from a file called Stars.jps.(Citation: Symantec Sowbug Nov 2017)
TSCookie	TSCookie has the ability to decrypt, load, and execute a DLL and its resources.(Citation: JPCert TSCookie March 2018)
Conti	Conti has decrypted its payload using a hardcoded AES-256 key.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)
Kwampirs	Kwampirs decrypts and extracts a copy of its main DLL payload when executing.(Citation: Symantec Orangeworm April 2018)
RainyDay	RainyDay can decrypt its payload via a XOR key.(Citation: Bitdefender Naikon April 2021)
Frankenstein	Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.(Citation: Talos Frankenstein June 2019)
DDKONG	DDKONG decodes an embedded configuration using XOR.(Citation: Rancor Unit42 June 2018)
Expand	Expand can be used to decompress a local or remote CAB file into an executable.(Citation: Microsoft Expand Utility)
Denis	Denis will decrypt important strings used for C&C communication.(Citation: Cybereason Cobalt Kitty 2017)
Bumblebee	Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.(Citation: Proofpoint Bumblebee April 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
Final1stspy	Final1stspy uses Python code to deobfuscate base64-encoded strings.(Citation: Unit 42 Nokki Oct 2018)
Ke3chang	Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.(Citation: Microsoft NICKEL December 2021)
BoomBox	BoomBox can decrypt AES-encrypted files downloaded from C2.(Citation: MSTIC Nobelium Toolset May 2021)
Chinoxy	The Chinoxy dropping function can initiate decryption of its config file.(Citation: Bitdefender FunnyDream Campaign November 2020)
Azorult	Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
Astaroth	Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. (Citation: Cybereason Astaroth Feb 2019)(Citation: Securelist Brazilian Banking Malware July 2020)
QakBot	QakBot can deobfuscate and re-assemble code strings for execution.(Citation: Cyberint Qakbot May 2021)(Citation: ATT QakBot April 2021)(Citation: Kaspersky QakBot September 2021)
Stuxnet	Stuxnet decrypts resources that are loaded into memory and executed.(Citation: Symantec W.32 Stuxnet Dossier)
Netwalker	Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.(Citation: Sophos Netwalker May 2020)
Squirrelwaffle	Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
AppleSeed	AppleSeed can decode its payload prior to execution.(Citation: Malwarebytes Kimsuky June 2021)
ABK	ABK has the ability to decrypt AES encrypted payloads.(Citation: Trend Micro Tick November 2019)
OopsIE	OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.(Citation: Unit 42 OopsIE! Feb 2018)
Winnti for Linux	Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.(Citation: Chronicle Winnti for Linux May 2019)
CharmPower	CharmPower can decrypt downloaded modules prior to execution.(Citation: Check Point APT35 CharmPower January 2022)
Ebury	Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.(Citation: ESET Ebury Oct 2017)
Molerats	Molerats decompresses ZIP files once on the victim machine.(Citation: Kaspersky MoleRATs April 2019)
Bisonal	Bisonal has decoded strings in the malware using XOR and RC4.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)
Darkhotel	Darkhotel has decrypted strings and imports using RC4 during execution.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)
PyDCrypt	PyDCrypt has decrypted and dropped the DCSrv payload to disk.(Citation: Checkpoint MosesStaff Nov 2021)
Rising Sun	Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.(Citation: McAfee Sharpshooter December 2018)
Crimson	Crimson can decode its encoded PE file prior to execution.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Torisma	Torisma has used XOR and Base64 to decode C2 data.(Citation: McAfee Lazarus Nov 2020)
Heyoka Backdoor	Heyoka Backdoor can decrypt its payload prior to execution.(Citation: SentinelOne Aoqin Dragon June 2022)
Earth Lusca	Earth Lusca has used certutil to decode a string into a cabinet file.(Citation: TrendMicro EarthLusca 2022)
Chrommme	Chrommme can decrypt its encrypted internal code.(Citation: ESET Gelsemium June 2021)
Bankshot	Bankshot decodes embedded XOR strings.(Citation: US-CERT Bankshot Dec 2017)
VERMIN	VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.(Citation: Unit 42 VERMIN Jan 2018)
LightNeuron	LightNeuron has used AES and XOR to decrypt configuration files and commands.(Citation: ESET LightNeuron May 2019)
Kessel	Kessel has decrypted the binary's configuration once the `main` function was launched.(Citation: ESET ForSSHe December 2018)
ISMInjector	ISMInjector uses the `certutil` command to decode a payload file.(Citation: OilRig New Delivery Oct 2017)
ZIRCONIUM	ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.(Citation: Check Point APT31 February 2021)
MuddyWater	MuddyWater decoded base64-encoded PowerShell commands using a VBS file.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater Jan 2022)
certutil	certutil has been used to decode binaries hidden inside certificate files as Base64 information.(Citation: Malwarebytes Targeted Attack against Saudi Arabia)
Taidoor	Taidoor can use a stream cipher to decrypt stings used by the malware.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
RDAT	RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.(Citation: Unit42 RDAT July 2020)
Egregor	Egregor has been decrypted before execution.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cybereason Egregor Nov 2020)
OilRig	A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Crowdstrike GTR2020 Mar 2020)
EnvyScout	EnvyScout can deobfuscate and write malicious ISO files to disk.(Citation: MSTIC Nobelium Toolset May 2021)
Bundlore	Bundlore has used `openssl` to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.(Citation: MacKeeper Bundlore Apr 2019)
HyperBro	HyperBro can unpack and decrypt its payload prior to execution.(Citation: Trend Micro DRBControl February 2020)(Citation: Trend Micro Iron Tiger April 2021)
Dyre	Dyre decrypts resources needed for targeting the victim.(Citation: Symantec Dyre June 2015)(Citation: Malwarebytes Dyreza November 2015)
Waterbear	Waterbear has the ability to decrypt its RC4 encrypted payload for execution.(Citation: Trend Micro Waterbear December 2019)
Ursnif	Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.(Citation: ProofPoint Ursnif Aug 2016)
Exaramel for Linux	Exaramel for Linux can decrypt its configuration file.(Citation: ANSSI Sandworm January 2021)
Avenger	Avenger has the ability to decrypt files downloaded from C2.(Citation: Trend Micro Tick November 2019)
YAHOYAH	YAHOYAH decrypts downloaded files before execution.(Citation: TrendMicro TropicTrooper 2015)
IceApple	IceApple can use a Base64-encoded AES key to decrypt tasking.(Citation: CrowdStrike IceApple May 2022)
BBK	BBK has the ability to decrypt AES encrypted payloads.(Citation: Trend Micro Tick November 2019)
Honeybee	Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.(Citation: McAfee Honeybee)
TYPEFRAME	One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".(Citation: US-CERT TYPEFRAME June 2018)
Pteranodon	Pteranodon can decrypt encrypted data strings prior to using them.(Citation: Microsoft Actinium February 2022)
Mori	Mori can resolve networking APIs from strings that are ADD-encrypted.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
WarzoneRAT	WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.(Citation: Check Point Warzone Feb 2020)
Green Lambert	Green Lambert can use multiple custom routines to decrypt strings prior to execution.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
Proton	Proton uses an encrypted file to store commands and configuration values.(Citation: objsee mac malware 2017)
Kobalos	Kobalos decrypts strings right after the initial communication, but before the authentication process.(Citation: ESET Kobalos Jan 2021)
BabyShark	BabyShark has the ability to decode downloaded files prior to execution.(Citation: CISA AA20-301A Kimsuky)
Carbon	Carbon decrypts task and configuration files for execution.(Citation: ESET Carbon Mar 2017)(Citation: Accenture HyperStack October 2020)
HermeticWiper	HermeticWiper can decompress and copy driver files using `LZCopy`.(Citation: Crowdstrike DriveSlayer February 2022)
Remexi	Remexi decrypts the configuration data using XOR with 25-character keys.(Citation: Securelist Remexi Jan 2019)
gh0st RAT	gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.(Citation: Gh0stRAT ATT March 2019)
Gamaredon Group	Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)
OSX/Shlayer	OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.(Citation: Carbon Black Shlayer Feb 2019) Versions of OSX/Shlayer pass encrypted and password-protected code to `openssl` and then write the payload to the `/tmp` folder.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)
PcShare	PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.(Citation: Bitdefender FunnyDream Campaign November 2020)
TA505	TA505 has decrypted packed DLLs with an XOR key.(Citation: NCC Group TA505)
CookieMiner	CookieMiner has used Google Chrome's decryption and extraction operations.(Citation: Unit42 CookieMiner Jan 2019)
DropBook	DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.(Citation: Cybereason Molerats Dec 2020)
RegDuke	RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.(Citation: ESET Dukes October 2019)
Shamoon	Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.(Citation: Unit 42 Shamoon3 2018)
Threat Group-3390	During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Securelist LuckyMouse June 2018)
APT28	An APT28 macro uses the command `certutil -decode` to decode contents of a .txt file storing the base64 encoded payload.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)
Skidmap	Skidmap has the ability to download, unpack, and decrypt tar.gz files .(Citation: Trend Micro Skidmap)
ROKRAT	ROKRAT can decrypt strings using the victim's hostname as the key.(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
Siloscape	Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the `unzip` binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.(Citation: Unit 42 Siloscape Jun 2021)
MESSAGETAP	After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. (Citation: FireEye MESSAGETAP October 2019)
ShimRat	ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.(Citation: FOX-IT May 2016 Mofang)
Drovorub	Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.(Citation: NSA/FBI Drovorub August 2020)
GoldMax	GoldMax has decoded and decrypted the configuration file when executed.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
MegaCortex	MegaCortex has used a Base64 key to decode its components.(Citation: IBM MegaCortex)
TeamTNT	TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.(Citation: Cisco Talos Intelligence Group)
Lizar	Lizar can decrypt its configuration data.(Citation: BiZone Lizar May 2021)
Turian	Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.(Citation: ESET BackdoorDiplomacy Jun 2021)
SideTwist	SideTwist can decode and decrypt messages received from C2.(Citation: Check Point APT34 April 2021)
REvil	REvil can decode encrypted strings to enable execution of commands and payloads.(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)
Agent Tesla	Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.(Citation: Malwarebytes Agent Tesla April 2020)
MacMa	MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.(Citation: ESET DazzleSpy Jan 2022)
WellMail	WellMail can decompress scripts received from C2.(Citation: CISA WellMail July 2020)
CoinTicker	CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.(Citation: CoinTicker 2019)
DarkWatchman	DarkWatchman has the ability to self-extract as a RAR archive.(Citation: Prevailion DarkWatchman 2021)
SharpStage	SharpStage has decompressed data received from the C2 server.(Citation: BleepingComputer Molerats Dec 2020)
menuPass	menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used `certutil -decode` to decode files on the victim’s machine when dropping UPPERCUT.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)
Sibot	Sibot can decrypt data received from a C2 and save to a file.(Citation: MSTIC NOBELIUM Mar 2021)
NativeZone	NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.(Citation: MSTIC Nobelium Toolset May 2021)
Pillowmint	Pillowmint has been decompressed by included shellcode prior to being launched.(Citation: Trustwave Pillowmint June 2020)
Lazarus Group	Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Hildegard	Hildegard has decrypted ELF files with AES.(Citation: Unit 42 Hildegard Malware)
ComRAT	ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
Grandoreiro	Grandoreiro can decrypt its encrypted internal strings.(Citation: ESET Grandoreiro April 2020)
Clambling	Clambling can deobfuscate its payload prior to execution.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
TrickBot	TrickBot decodes the configuration data and modules.(Citation: Fidelis TrickBot Oct 2016)(Citation: Cyberreason Anchor December 2019)(Citation: Joe Sec Trickbot)
FIVEHANDS	FIVEHANDS has the ability to decrypt its payload prior to execution.(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)
Saint Bot	Saint Bot can deobfuscate strings and files for execution.(Citation: Malwarebytes Saint Bot April 2021)
Cobalt Strike	Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Shark	Shark can extract and decrypt downloaded .zip files.(Citation: ClearSky Siamesekitten August 2021)
IronNetInjector	IronNetInjector has the ability to decrypt embedded .NET and PE payloads.(Citation: Unit 42 IronNetInjector February 2021 )
Spark	Spark has used a custom XOR algorithm to decrypt the payload.(Citation: Unit42 Molerat Mar 2020)
Okrum	Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.(Citation: ESET Okrum July 2019)
WindTail	WindTail has the ability to decrypt strings using hard-coded AES keys.(Citation: objective-see windtail1 dec 2018)
InvisiMole	InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
HiddenWasp	HiddenWasp uses a cipher to implement a decoding function.(Citation: Intezer HiddenWasp Map 2019)
ThreatNeedle	ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.(Citation: Kaspersky ThreatNeedle Feb 2021)
SQLRat	SQLRat has scripts that are responsible for deobfuscating additional scripts.(Citation: Flashpoint FIN 7 March 2019)
SUNSPOT	SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.(Citation: CrowdStrike SUNSPOT Implant January 2021)
Valak	Valak has the ability to decode and decrypt downloaded files.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)
Leviathan	Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.(Citation: Proofpoint Leviathan Oct 2017)
TEARDROP	TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Check Point Sunburst Teardrop December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)
PUNCHBUGGY	PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.(Citation: Morphisec ShellTea June 2019)
NOKKI	NOKKI uses a unique, custom de-obfuscation technique.(Citation: Unit 42 NOKKI Sept 2018)
PS1	PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.(Citation: BlackBerry CostaRicto November 2020)
Cardinal RAT	Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.(Citation: PaloAlto CardinalRat Apr 2017)
WhisperGate	WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
Rocke	Rocke has extracted tar.gz files after downloading them from a C2 server.(Citation: Talos Rocke August 2018)
GrimAgent	GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.(Citation: Group IB GrimAgent July 2021)
PowGoop	PowGoop can decrypt PowerShell scripts for execution.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)
WellMess	WellMess can decode and decrypt data received from C2.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)(Citation: CISA WellMess July 2020)
FYAnti	FYAnti has the ability to decrypt an embedded .NET module.(Citation: Securelist APT10 March 2021)
Goopy	Goopy has used a polymorphic decryptor to decrypt itself at runtime.(Citation: Cybereason Cobalt Kitty 2017)
WastedLocker	WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.(Citation: NCC Group WastedLocker June 2020)
PlugX	PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.(Citation: CIRCL PlugX March 2013)(Citation: Trend Micro DRBControl February 2020)(Citation: Proofpoint TA416 Europe March 2022)
Kerrdown	Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.(Citation: Unit 42 KerrDown February 2019)
DanBot	DanBot can use a VBA macro to decode its payload prior to installation and execution.(Citation: SecureWorks August 2019)
PingPull	PingPull can decrypt received data from its C2 server by using AES.(Citation: Unit 42 PingPull Jun 2022)
BADFLICK	BADFLICK can decode shellcode using a custom rotating XOR cipher.(Citation: Accenture MUDCARP March 2019)
PipeMon	PipeMon can decrypt password-protected executables.(Citation: ESET PipeMon May 2020)
RGDoor	RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.(Citation: Unit 42 RGDoor Jan 2018)
FinFisher	FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Tropic Trooper	Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
Amadey	Amadey has decoded antivirus name strings.(Citation: Korean FSI TA505 2020)
	During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.(Citation: Talos Frankenstein June 2019)
AuditCred	AuditCred uses XOR and RC4 to perform decryption on the code functions.(Citation: TrendMicro Lazarus Nov 2018)
Winnti for Windows	The Winnti for Windows dropper can decrypt and decompresses a data blob.(Citation: Novetta Winnti April 2015)
Bazar	Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
PoetRAT	PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.(Citation: Talos PoetRAT October 2020)
Sandworm Team	Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)
PowerLess	PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.(Citation: Cybereason PowerLess February 2022)
OnionDuke	OnionDuke can use a custom decryption algorithm to decrypt strings.(Citation: ESET Dukes October 2019)
	During Operation Dust Storm, attackers used VBS code to decode payloads.(Citation: Cylance Dust Storm)
Zebrocy	Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)
Zeus Panda	Zeus Panda decrypts strings in the code during the execution process.(Citation: Talos Zeus Panda Nov 2017)
BackConfig	BackConfig has used a custom routine to decrypt strings.(Citation: Unit 42 BackConfig May 2020)
Cyclops Blink	Cyclops Blink can decrypt and parse instructions sent from C2.(Citation: NCSC Cyclops Blink February 2022)
BLINDINGCAN	BLINDINGCAN has used AES and XOR to decrypt its DLLs.(Citation: US-CERT BLINDINGCAN Aug 2020)
Chaes	Chaes has decrypted an AES encrypted binary file to trigger the download of other files.(Citation: Cybereason Chaes Nov 2020)
Bandook	Bandook has decoded its PowerShell script.(Citation: CheckPoint Bandook Nov 2020)
SoreFang	SoreFang can decode and decrypt exfiltrated data sent to C2.(Citation: CISA SoreFang July 2016)
Ramsay	Ramsay can extract its agent from the body of a malicious document.(Citation: Eset Ramsay May 2020)
MirageFox	MirageFox has a function for decrypting data containing C2 configuration information.(Citation: APT15 Intezer June 2018)
xCaon	xCaon has decoded strings from the C2 server before executing commands.(Citation: Checkpoint IndigoZebra July 2021)
Metamorfo	Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.(Citation: Medium Metamorfo Apr 2020)(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019)
KGH_SPY	KGH_SPY can decrypt encrypted strings and write them to a newly created folder.(Citation: Cybereason Kimsuky November 2020)
CostaBricks	CostaBricks has the ability to use bytecode to decrypt embedded payloads.(Citation: BlackBerry CostaRicto November 2020)
RogueRobin	RogueRobin decodes an embedded executable using base64 and decompresses it.(Citation: Unit42 DarkHydrus Jan 2019)
Industroyer	Industroyer decrypts code to connect to a remote C2 server.(Citation: ESET Industroyer)
ZxxZ	ZxxZ has used a XOR key to decrypt strings.(Citation: Cisco Talos Bitter Bangladesh May 2022)
	During Operation Honeybee, malicious files were decoded prior to execution.(Citation: McAfee Honeybee)
APT19	An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.(Citation: Unit 42 C0d0so0 Jan 2016)
Ecipekac	Ecipekac has the ability to decrypt fileless loader modules.(Citation: Securelist APT10 March 2021)
Higaisa	Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
FatDuke	FatDuke can decrypt AES encrypted C2 communications.(Citation: ESET Dukes October 2019)
Volgmer	Volgmer deobfuscates its strings and APIs once its executed.(Citation: US-CERT Volgmer 2 Nov 2017)
LookBack	LookBack has a function that decrypts malicious data.(Citation: Proofpoint LookBack Malware Aug 2019)
PolyglotDuke	PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.(Citation: ESET Dukes October 2019)
Raindrop	Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Dtrack	Dtrack has used a decryption routine that is part of an executable physical patch.(Citation: Securelist Dtrack)
Hancitor	Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)

Контрмера	Описание
Контрмеры
Deobfuscate/Decode Files or Information Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to deobfuscate or decode files or information, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as certutil. Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Деобфускация/декодирование файлов или информации

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги