Obfuscated Files or Information

AbstractEmu has encoded files, such as exploit binaries, to potentially use during and after the rooting process.^[2]

AhRat can use an encryption key received from its C2 to encrypt and decrypt configuration files and exfiltrated data.^[3]

Android/AdDisplay.Ashas has hidden the C2 server address using base-64 encoding. ^[4]

AndroidOS/MalLocker.B has employed both name mangling and meaningless variable names in source. AndroidOS/MalLocker.B has stored encrypted payload code in the Assets directory, coupled with a custom decryption routine that assembles a .dex file by passing data through Android Intent objects. ^[1]

Asacub has stored encrypted strings in the APK file.^[5]

BrainTest stores a secondary Android app package (APK) in its assets directory in encrypted form, and decrypts the payload at runtime.^[6]

BRATA has employed code obfuscation and encryption of configuration files.^[7][8]

Bread uses various tricks to obfuscate its strings including standard and custom encryption, programmatically building strings at runtime, and splitting unencrypted strings with repeated delimiters to break up keywords. Bread has also abused Java and JavaScript features to obfuscate code. Bread payloads have hidden code in native libraries and encrypted JAR files in the data section of an ELF file. Bread has stored DEX payloads as base64-encoded strings in the Android manifest and internal Java classes.^[9][10]

During C0033, PROMETHIUM used StrongPity to obfuscate code and strings to evade detection.^[11]

CarbonSteal has used incorrect file extensions and encryption to hide most of its assets, including secondary APKs, configuration files, and JAR or DEX files.^[12]

Cerberus uses standard payload and string obfuscation techniques.^[13]

Charger encodes strings into binary arrays to make it difficult to inspect them. It also loads code from encrypted resources dynamically and includes meaningless commands that mask the actual commands passing through.^[14]

CHEMISTGAMES has encrypted its DEX payload.^[15]

DoubleAgent has used an AES encrypted file in the assets folder with an unsuspecting name (e.g. ‘GoogleMusic.png’) for holding configuration and C2 information.^[12]

Drinik has used custom encryption to hide strings, potentially to evade antivirus products.^[16]

Dvmap decrypts executables from archive files stored in the assets directory of the installation binary.^[17]

EventBot dynamically loads its malicious functionality at runtime from an RC4-encrypted TTF file. EventBot also utilizes ProGuard to obfuscate the generated APK file.^[18]

FakeSpy stores its malicious code in encrypted asset files that are decrypted at runtime. Newer versions of FakeSpy encrypt the C2 address.^[19]

FlexiSpy encrypts its configuration file using AES.^[20]

FluBot can obfuscated class, string, and method names in newer malware versions.^[21]

Ginp obfuscates its payload, code, and strings.^[22]

GolfSpy encodes its configurations using a customized algorithm.^[23]

GPlayed has base64-encoded the exfiltrated data, replacing some of the base64 characters to further obfuscate the data.^[24]

Gustuff obfuscated command information using a custom base85-based encoding.^[25]

HenBox has obfuscated components using XOR, ZIP with a single-byte key or ZIP/Zlib compression wrapped with RC4 encryption.^[26]

INSOMNIA obfuscates various pieces of information within the application.^[27]

Mandrake obfuscates its hardcoded C2 URLs.^[28]

Monokle uses XOR to obfuscate its second stage binary.^[29]

OBAD contains encrypted code along with an obfuscated decryption routine to make it difficult to analyze.^[30]

Pallas stores domain information and URL paths as hardcoded AES-encrypted, base64-encoded strings.^[31]

Red Alert 2.0 has stored data embedded in the strings.xml resource file.^[32]

Starting in 2017, the Rotexy DEX file was packed with garbage strings and/or operations.^[33]

SharkBot can use a Domain Generation Algorithm to decode the C2 server location.^[34]

SilkBean has hidden malicious functionality in a second stage file and has encrypted C2 server information.^[12]

TERRACOTTA has stored encoded strings.^[35]

TianySpy has encrypted C2 details, email addresses, and passwords.^[36]

TrickMo contains obfuscated function, class, and variable names, and encrypts its shared preferences using Java’s PBEWithMD5AndDES algorithm.^[37]

Windshift has encrypted application strings using AES in ECB mode and Blowfish, and stored strings encoded in hex during Operation BULL. Further, in Operation BULL, encryption keys were stored within the application’s launcher icon file.^[38]

WireLurker obfuscates its payload through complex code structure, multiple component versions, file hiding, code obfuscation and customized encryption to thwart anti-reversing.^[39]

WolfRAT’s code is obfuscated.^[40]

XLoader for Android loads an encrypted DEX code payload.^[41]

Zen base64 encodes one of the strings it searches for.^[42]