Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.[1] Another example is using the Windows copy /b
command to reassemble binary fragments into a malicious payload.[2]
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. [3]
ID | Name | Description |
---|---|---|
S0469 | ABK | |
S1028 | Action RAT |
Action RAT can use Base64 to decode actor-controlled C2 server communications.[5] |
S0331 | Agent Tesla |
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.[6] |
G1030 | Agrius |
Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.[7] |
S1025 | Amadey | |
S1133 | Apostle |
Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.[7] |
S0584 | AppleJeus | |
S0622 | AppleSeed | |
G0073 | APT19 |
An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.[11] |
G0007 | APT28 |
An APT28 macro uses the command |
G0087 | APT39 | |
S0456 | Aria-body |
Aria-body has the ability to decrypt the loader configuration and payload DLL.[15] |
S0373 | Astaroth |
Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. [16][17] |
S0347 | AuditCred |
AuditCred uses XOR and RC4 to perform decryption on the code functions.[18] |
S0640 | Avaddon | |
S0473 | Avenger |
Avenger has the ability to decrypt files downloaded from C2.[4] |
S1053 | AvosLocker |
AvosLocker has deobfuscated XOR-encoded strings.[20] |
S0344 | Azorult |
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.[21][22] |
S0638 | Babuk |
Babuk has the ability to unpack itself into memory using XOR.[23][24] |
S0414 | BabyShark |
BabyShark has the ability to decode downloaded files prior to execution.[25] |
S0475 | BackConfig |
BackConfig has used a custom routine to decrypt strings.[26] |
S0642 | BADFLICK |
BADFLICK can decode shellcode using a custom rotating XOR cipher.[27] |
S0234 | Bandook | |
S0239 | Bankshot | |
S0534 | Bazar |
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.[30][31] |
S0470 | BBK | |
S0127 | BBSRAT |
BBSRAT uses Expand to decompress a CAB file into executable content.[32] |
S0574 | BendyBear |
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.[33] |
S0268 | Bisonal |
Bisonal has decoded strings in the malware using XOR and RC4.[34][35] |
S0520 | BLINDINGCAN |
BLINDINGCAN has used AES and XOR to decrypt its DLLs.[36] |
S0635 | BoomBox |
BoomBox can decrypt AES-encrypted files downloaded from C2.[37] |
S0415 | BOOSTWRITE |
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.[38] |
G0060 | BRONZE BUTLER |
BRONZE BUTLER downloads encoded payloads and decodes them on the victim.[39] |
S1063 | Brute Ratel C4 |
Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.[40] |
S1039 | Bumblebee |
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.[41][42] |
S0482 | Bundlore |
Bundlore has used |
S1118 | BUSHWALK |
BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.[44][45] |
C0017 | C0017 |
During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.[46] |
C0021 | C0021 |
During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string |
S0335 | Carbon |
Carbon decrypts task and configuration files for execution.[49][50] |
S0348 | Cardinal RAT |
Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.[51] |
S0160 | certutil |
certutil has been used to decode binaries hidden inside certificate files as Base64 information.[1] |
S0631 | Chaes |
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.[52] |
S0674 | CharmPower |
CharmPower can decrypt downloaded modules prior to execution.[53] |
S1149 | CHIMNEYSWEEP |
CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.[54] |
S1041 | Chinoxy |
The Chinoxy dropping function can initiate decryption of its config file.[55] |
S0667 | Chrommme | |
G1021 | Cinnamon Tempest |
Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.[57] |
S0660 | Clambling |
Clambling can deobfuscate its payload prior to execution.[58][59] |
S0611 | Clop |
Clop has used a simple XOR operation to decrypt strings.[60] |
S1105 | COATHANGER |
COATHANGER decodes configuration items from a bundled file for command and control activity.[61] |
S0154 | Cobalt Strike |
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.[62][63] |
S0369 | CoinTicker |
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.[64] |
S0126 | ComRAT |
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.[65][66] |
S0575 | Conti |
Conti has decrypted its payload using a hardcoded AES-256 key.[67][68] |
S0492 | CookieMiner |
CookieMiner has used Google Chrome's decryption and extraction operations.[69] |
S0614 | CostaBricks |
CostaBricks has the ability to use bytecode to decrypt embedded payloads.[70] |
S0115 | Crimson |
Crimson can decode its encoded PE file prior to execution.[71] |
S1153 | Cuckoo Stealer |
Cuckoo Stealer strings are deobfuscated prior to execution.[72][73] |
S0687 | Cyclops Blink |
Cyclops Blink can decrypt and parse instructions sent from C2.[74] |
S1014 | DanBot |
DanBot can use a VBA macro to decode its payload prior to installation and execution.[75] |
S1111 | DarkGate |
DarkGate installation includes binary code stored in a file located in a hidden directory, such as |
G0012 | Darkhotel |
Darkhotel has decrypted strings and imports using RC4 during execution.[78][79] |
S1066 | DarkTortilla |
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.[80] |
S0673 | DarkWatchman |
DarkWatchman has the ability to self-extract as a RAR archive.[81] |
S0255 | DDKONG | |
S1052 | DEADEYE |
DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.[46] |
S1134 | DEADWOOD |
DEADWOOD XORs some strings within the binary using the value |
S0354 | Denis |
Denis will decrypt important strings used for C&C communication.[83] |
S0547 | DropBook |
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.[84] |
S0502 | Drovorub |
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.[85] |
S0567 | Dtrack |
Dtrack has used a decryption routine that is part of an executable physical patch.[86] |
S1158 | DUSTPAN | |
S1159 | DUSTTRAP | |
S0024 | Dyre |
Dyre decrypts resources needed for targeting the victim.[88][89] |
G1006 | Earth Lusca |
Earth Lusca has used certutil to decode a string into a cabinet file.[90] |
S0377 | Ebury |
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.[91] |
S0624 | Ecipekac |
Ecipekac has the ability to decrypt fileless loader modules.[92] |
S0554 | Egregor | |
S0367 | Emotet |
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.[95] |
S0634 | EnvyScout |
EnvyScout can deobfuscate and write malicious ISO files to disk.[37] |
S0401 | Exaramel for Linux |
Exaramel for Linux can decrypt its configuration file.[96] |
S0361 | Expand |
Expand can be used to decompress a local or remote CAB file into an executable.[97] |
S0512 | FatDuke | |
G1016 | FIN13 |
FIN13 has utilized |
S0355 | Final1stspy |
Final1stspy uses Python code to deobfuscate base64-encoded strings.[100] |
S0182 | FinFisher |
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.[101][102] |
S0618 | FIVEHANDS |
FIVEHANDS has the ability to decrypt its payload prior to execution.[103][104][105] |
S0661 | FoggyWeb |
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.[106] |
S1120 | FRAMESTING |
FRAMESTING can decompress data received within |
C0001 | Frankenstein |
During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.[107] |
S0628 | FYAnti |
FYAnti has the ability to decrypt an embedded .NET module.[92] |
G0047 | Gamaredon Group |
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.[108][109] Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.[110] |
S0666 | Gelsemium |
Gelsemium can decompress and decrypt DLLs and shellcode.[56] |
S0032 | gh0st RAT |
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.[111] |
S1117 | GLASSTOKEN |
GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.[112] |
S0588 | GoldMax |
GoldMax has decoded and decrypted the configuration file when executed.[113][114] |
S0477 | Goopy |
Goopy has used a polymorphic decryptor to decrypt itself at runtime.[83] |
S1138 | Gootloader |
Gootloader has the ability to decode and decrypt malicious payloads prior to execution.[115][116] |
G0078 | Gorgon Group |
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.[117] |
S0531 | Grandoreiro |
Grandoreiro can decrypt its encrypted internal strings.[118] |
S0690 | Green Lambert |
Green Lambert can use multiple custom routines to decrypt strings prior to execution.[119][120] |
S0632 | GrimAgent |
GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.[121] |
S0499 | Hancitor |
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.[122][123] |
S0697 | HermeticWiper |
HermeticWiper can decompress and copy driver files using |
S1027 | Heyoka Backdoor |
Heyoka Backdoor can decrypt its payload prior to execution.[125] |
S0394 | HiddenWasp |
HiddenWasp uses a cipher to implement a decoding function.[126] |
G0126 | Higaisa |
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.[127][128] |
S0601 | Hildegard | |
S1097 | HUI Loader |
HUI Loader can decrypt and load files containing malicious payloads.[130] |
S0398 | HyperBro |
HyperBro can unpack and decrypt its payload prior to execution.[58][131] |
S1022 | IceApple |
IceApple can use a Base64-encoded AES key to decrypt tasking.[132] |
S0434 | Imminent Monitor |
Imminent Monitor has decoded malware components that are then dropped to the system.[133] |
S1139 | INC Ransomware |
INC Ransomware can run |
S0604 | Industroyer |
Industroyer decrypts code to connect to a remote C2 server.[135] |
S0260 | InvisiMole |
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.[136][137] |
S0581 | IronNetInjector |
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.[138] |
S0189 | ISMInjector |
ISMInjector uses the |
G0004 | Ke3chang |
Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.[140] |
S0585 | Kerrdown |
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.[141] |
S0487 | Kessel |
Kessel has decrypted the binary's configuration once the |
S1051 | KEYPLUG |
KEYPLUG can decode its configuration file to determine C2 protocols.[46] |
S0526 | KGH_SPY |
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.[143] |
G0094 | Kimsuky | |
S0641 | Kobalos |
Kobalos decrypts strings right after the initial communication, but before the authentication process.[145] |
S0669 | KOCTOPUS |
KOCTOPUS has deobfuscated itself before executing its commands.[146] |
S0356 | KONNI |
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.[147][148] |
S0236 | Kwampirs |
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.[149] |
S1160 | Latrodectus |
Latrodectus has the ability to deobfuscate encrypted strings.[150][151][152] |
G0032 | Lazarus Group |
Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.[153][154] |
G0065 | Leviathan |
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.[155] |
S0395 | LightNeuron |
LightNeuron has used AES and XOR to decrypt configuration files and commands.[156] |
S1119 | LIGHTWIRE |
LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.[44] |
S0513 | LiteDuke |
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.[98] |
S0681 | Lizar | |
S0447 | Lokibot |
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.[158] |
S0582 | LookBack | |
S0532 | Lucifer | |
S1143 | LunarLoader |
LunarLoader can deobfuscate files containing the next stages in the infection chain.[161] |
S1142 | LunarMail |
LunarMail can decrypt strings to retrieve configuration settings.[161] |
S1141 | LunarWeb |
LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.[161] |
S0409 | Machete | |
S1016 | MacMa |
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.[163] |
S1060 | Mafalda | |
G1026 | Malteiro |
Malteiro has the ability to deobfuscate downloaded files prior to execution.[165] |
S0576 | MegaCortex |
MegaCortex has used a Base64 key to decode its components.[166] |
G0045 | menuPass |
menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used |
S0443 | MESSAGETAP |
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. [169] |
S1059 | metaMain | |
S0455 | Metamorfo |
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.[170][171][172] |
S0280 | MirageFox |
MirageFox has a function for decrypting data containing C2 configuration information.[173] |
S1122 | Mispadu |
Mispadu decrypts its encrypted configuration files prior to execution.[165][174] |
G0021 | Molerats |
Molerats decompresses ZIP files once on the victim machine.[175] |
S1026 | Mongall |
Mongall has the ability to decrypt its payload prior to execution.[125] |
G1036 | Moonstone Sleet |
Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.[176] |
S0284 | More_eggs |
More_eggs will decode malware components that are then dropped to the system.[177] |
S1047 | Mori |
Mori can resolve networking APIs from strings that are ADD-encrypted.[178] |
G0069 | MuddyWater |
MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.[179][180][181][182] |
S0637 | NativeZone |
NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.[37] |
S0457 | Netwalker |
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.[183] |
S1147 | Nightdoor |
Nightdoor stores network configuration data in a file XOR encoded with the key value of |
S1100 | Ninja |
The Ninja loader component can decrypt and decompress the payload.[185][186] |
S0353 | NOKKI | |
G0049 | OilRig |
A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.[188][139][189][190] |
S0439 | Okrum |
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.[191] |
S0052 | OnionDuke |
OnionDuke can use a custom decryption algorithm to decrypt strings.[98] |
S0264 | OopsIE |
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.[189] |
C0016 | Operation Dust Storm |
During Operation Dust Storm, attackers used VBS code to decode payloads.[192] |
C0006 | Operation Honeybee |
During Operation Honeybee, malicious files were decoded prior to execution.[193] |
C0005 | Operation Spalax |
For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.[194] |
S0402 | OSX/Shlayer |
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.[195] Versions of OSX/Shlayer pass encrypted and password-protected code to |
S0352 | OSX_OCEANLOTUS.D |
OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the |
S0598 | P.A.S. Webshell |
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.[96] |
S1050 | PcShare |
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.[55] |
S1145 | Pikabot |
Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm.[199] Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload |
S0517 | Pillowmint |
Pillowmint has been decompressed by included shellcode prior to being launched.[202] |
S1031 | PingPull |
PingPull can decrypt received data from its C2 server by using AES.[203] |
S0501 | PipeMon | |
S1123 | PITSTOP |
PITSTOP can deobfuscate base64 encoded and AES encrypted commands.[45] |
S0013 | PlugX |
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.[205][58][206] |
S0428 | PoetRAT |
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.[207] |
S0518 | PolyglotDuke |
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.[98] |
S1012 | PowerLess |
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.[208] |
S0223 | POWERSTATS |
POWERSTATS can deobfuscate the main backdoor code.[181] |
S1046 | PowGoop |
PowGoop can decrypt PowerShell scripts for execution.[178][209] |
S0279 | Proton |
Proton uses an encrypted file to store commands and configuration values.[210] |
S0613 | PS1 |
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.[70] |
S0147 | Pteranodon |
Pteranodon can decrypt encrypted data strings prior to using them.[211] |
S0196 | PUNCHBUGGY |
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.[212] |
S1032 | PyDCrypt |
PyDCrypt has decrypted and dropped the DCSrv payload to disk.[213] |
S0650 | QakBot |
QakBot can deobfuscate and re-assemble code strings for execution.[214][215][216] |
S0269 | QUADAGENT |
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.[217] |
S1076 | QUIETCANARY |
QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.[218] |
S1148 | Raccoon Stealer |
Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.[219][220] |
S0565 | Raindrop |
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.[221][222] |
S0629 | RainyDay | |
S0458 | Ramsay |
Ramsay can extract its agent from the body of a malicious document.[224] |
S1113 | RAPIDPULSE |
RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter |
S1130 | Raspberry Robin |
Raspberry Robin contains several layers of obfuscation to hide malicious code from detection and analysis.[226] |
S0495 | RDAT |
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.[227] |
S0511 | RegDuke |
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.[98] |
S0375 | Remexi |
Remexi decrypts the configuration data using XOR with 25-character keys.[228] |
S0496 | REvil |
REvil can decode encrypted strings to enable execution of commands and payloads.[229][230][231][232][233][234] |
S0258 | RGDoor |
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.[235] |
S0448 | Rising Sun |
Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.[236] |
S1150 | ROADSWEEP |
ROADSWEEP can decrypt embedded scripts prior to execution.[54][237] |
G0106 | Rocke |
Rocke has extracted tar.gz files after downloading them from a C2 server.[238] |
S0270 | RogueRobin |
RogueRobin decodes an embedded executable using base64 and decompresses it.[239] |
S0240 | ROKRAT |
ROKRAT can decrypt strings using the victim's hostname as the key.[240][241] |
S1078 | RotaJakiro |
RotaJakiro uses the AES algorithm, bit shifts in a function called |
S1018 | Saint Bot |
Saint Bot can deobfuscate strings and files for execution.[243] |
G0034 | Sandworm Team |
Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.[244][245] |
S1085 | Sardonic |
Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.[246] |
S0461 | SDBbot |
SDBbot has the ability to decrypt and decompress its payload to enable code execution.[247][248] |
S0596 | ShadowPad |
ShadowPad has decrypted a binary blob to start execution.[249] |
S0140 | Shamoon |
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.[250] |
S1019 | Shark | |
S0546 | SharpStage |
SharpStage has decompressed data received from the C2 server.[252] |
S0444 | ShimRat |
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.[253] |
S0589 | Sibot |
Sibot can decrypt data received from a C2 and save to a file.[113] |
S0610 | SideTwist |
SideTwist can decode and decrypt messages received from C2.[254] |
S0623 | Siloscape |
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the |
S0468 | Skidmap |
Skidmap has the ability to download, unpack, and decrypt tar.gz files .[256] |
S1110 | SLIGHTPULSE |
SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.[257] |
S0226 | Smoke Loader |
Smoke Loader deobfuscates its code.[258] |
S1086 | Snip3 |
Snip3 can decode its second-stage PowerShell script prior to execution.[259] |
C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.[221] |
S0615 | SombRAT |
SombRAT can run |
S0516 | SoreFang |
SoreFang can decode and decrypt exfiltrated data sent to C2.[260] |
S0543 | Spark |
Spark has used a custom XOR algorithm to decrypt the payload.[261] |
S1140 | Spica |
Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.[262] |
S0390 | SQLRat |
SQLRat has scripts that are responsible for deobfuscating additional scripts.[263] |
S1030 | Squirrelwaffle |
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.[264][265] |
S0188 | Starloader |
Starloader decrypts and executes shellcode from a file called Stars.jps.[266] |
S1112 | STEADYPULSE |
STEADYPULSE can URL decode key/value pairs sent over C2.[257] |
S0603 | Stuxnet |
Stuxnet decrypts resources that are loaded into memory and executed.[267] |
S0562 | SUNSPOT |
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.[268] |
S0663 | SysUpdate | |
G0092 | TA505 | |
S0011 | Taidoor |
Taidoor can use a stream cipher to decrypt stings used by the malware.[270] |
G0139 | TeamTNT |
TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.[271] |
S0560 | TEARDROP |
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.[272][273][222] |
G0027 | Threat Group-3390 |
During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.[274] |
S0665 | ThreatNeedle |
ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.[275] |
S0678 | Torisma | |
S0266 | TrickBot |
TrickBot decodes the configuration data and modules.[277][278][279] |
G0081 | Tropic Trooper |
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.[280][281] |
S0436 | TSCookie |
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.[282] |
S0647 | Turian |
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.[283] |
G0010 | Turla |
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.[284] |
S0263 | TYPEFRAME |
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".[285] |
S0022 | Uroburos |
Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.[286] |
S0386 | Ursnif |
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.[287] |
S0476 | Valak |
Valak has the ability to decode and decrypt downloaded files.[288][289] |
S0636 | VaporRage |
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.[37] |
S0257 | VERMIN |
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.[290] |
S0180 | Volgmer |
Volgmer deobfuscates its strings and APIs once its executed.[291] |
S0670 | WarzoneRAT |
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.[292] |
S0612 | WastedLocker |
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.[293] |
C0037 | Water Curupira Pikabot Distribution |
Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.[294] |
S0579 | Waterbear |
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.[295] |
S0515 | WellMail | |
S0514 | WellMess |
WellMess can decode and decrypt data received from C2.[297][298][299] |
S0689 | WhisperGate |
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.[300][301] |
S0466 | WindTail |
WindTail has the ability to decrypt strings using hard-coded AES keys.[302] |
S0430 | Winnti for Linux |
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.[303] |
S0141 | Winnti for Windows |
The Winnti for Windows dropper can decrypt and decompresses a data blob.[304] |
G1035 | Winter Vivern |
Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.[305] |
S1115 | WIREFIRE |
WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP |
G0090 | WIRTE | |
S1065 | Woody RAT |
Woody RAT can deobfuscate Base64-encoded strings and scripts.[308] |
S0653 | xCaon |
xCaon has decoded strings from the C2 server before executing commands.[309] |
S0388 | YAHOYAH | |
S0251 | Zebrocy |
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.[311][312] |
S0230 | ZeroT |
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.[313] |
S0330 | Zeus Panda |
Zeus Panda decrypts strings in the code during the execution process.[314] |
G0128 | ZIRCONIUM |
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.[315] |
S1013 | ZxxZ |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0022 | File | File Modification |
Monitor for changes made to files for unexpected modifications that attempt to hide artifacts. On Windows, Event ID 4663 (Security Log - An attempt was made to access an object) can be used to alert on suspicious file accesses (e.g., attempting to write to a file which shouldn’t be further modified) that may coincide with attempts to hide artifacts. |
DS0009 | Process | Process Creation |
Monitor for newly executed processes that attempt to hide artifacts of an intrusion, such as common archive file applications and extensions (ex: Zip and RAR archive tools), and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding an encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. Analytic Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created). The analytic is oriented around the creation of CertUtil.exe processes, which may be used to encode and decode files, including PE and script code. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Analytic 1 - CertUtil with Decode Argument
|
DS0012 | Script | Script Execution |
Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. |