Obfuscated Files or Information: Encrypted/Encoded File

APT18 obfuscates strings in the payload.^[3]

APT19 used Base64 to obfuscate payloads.^[4]

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.^{[5][6][7][8][9]}

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.^{[10][11][12][13][14][15][16]}

APT33 has used base64 to encode payloads.^[17]

APT39 has used malware to drop encrypted CAB files.^[18]

APT41 DUST used encrypted payloads decrypted and executed in memory.^[19]

Aria-body has used an encrypted configuration file for its loader.^[20]

Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.^[21]

Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.^[22]

AuditCred encrypts the configuration.^[23]

Avenger has the ability to XOR encrypt files to be sent to C2.^[24]

Bazar has used XOR, RSA2, and RC4 encrypted files.^[25][26][27]

BendyBear has encrypted payloads using RC4 and XOR.^[28]

Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.^[29][30]

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.^[31]

BITTER has used a RAR SFX dropper to deliver malware.^[32]

BlackByte Ransomware is distributed as an encrypted payload.^[33]

BLINDINGCAN has obfuscated code using Base64 encoding.^[34]

Blue Mockingbird has obfuscated the wallet address in the payload binary.^[35]

BLUELIGHT has a XOR-encoded payload.^[36]

BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.^[37]

Carberp has used XOR-based encryption to mask C2 server locations within the trojan.^[38]

Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.^[39]

CARROTBAT has the ability to download a base64 encoded payload.^[40]

Chinoxy has encrypted its configuration file.^[41]

Chrommme can encrypt sections of its code to evade detection.^[42]

The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.^[43]

Cuckoo Stealer strings are XOR-encrypted.^[44][45]

During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure dsls binary.^[46]

Dacls can encrypt its configuration file with AES CBC.^[47]

DanBot can Base64 encode its payload.^[48]

Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.^[49]

DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation.^[50] DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.^[51]

Darkhotel has obfuscated code using RC4, XOR, and RSA.^[52][53]

DCSrv's configuration is encrypted.^[54]

DEADEYE has encrypted its payload.^[55]

DEADWOOD contains an embedded, AES-encrypted resource named METADATA that contains configuration information for follow-on execution.^[56]

DOGCALL is encrypted using single-byte XOR.^[57]

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.^[58]

DUSTPAN decrypts an embedded payload.^[19][59]

DUSTTRAP begins with an initial launcher that decrypts an AES-128-CFB encrypted file on disk and executes it in memory.^[19]

Elderwood has encrypted documents and malicious executables.^[60]

Elise encrypts several of its files, including configuration files.^[61]

Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.^[62][63]

Emotet uses obfuscated URLs to download a ZIP file.^[64]

EnvyScout can Base64 encode payloads.^[65]

Exaramel for Linux uses RC4 for encrypting the configuration.^[66][67]

FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.^[68][69]

The FIVEHANDS payload is encrypted with AES-128.^[70][71][72]

FlawedGrace encrypts its C2 configuration files with AES in CBC mode.^[73]

FoggyWeb has been XOR-encoded.^[74]

Fox Kitten has base64 encoded payloads to avoid detection.^[75]

FunnyDream can Base64 encode its C2 address stored in a template binary with the xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_- orxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_= character sets.^[41]

Fysbis has been encrypted using XOR and RC4.^[76]

Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.^[77]

GoldenSpy's uninstaller has base64-encoded its variables. ^[78]

GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.^[79][80]

The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.^[21][81][81]

GravityRAT supports file encryption (AES with the key "lolomycin2017").^[82]

GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.^[69]

Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.^[83]

HAWKBALL has encrypted the payload with an XOR-based algorithm.^[84]

The Helminth config file is encrypted with RC4.^[85]

HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.^[86]

Heyoka Backdoor can encrypt its payload.^[87]

Hi-Zor uses various XOR techniques to obfuscate its components.^[88]

HiddenWasp encrypts its configuration and payload.^[89]

Higaisa used Base64 encoded compressed payloads.^[90][91]

Hildegard has encrypted an ELF file.^[92]

Some strings in HOMEFRY are obfuscated with XOR x56.^[93]

HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.^[94]

HyperBro can be delivered encrypted to a compromised host.^[95]

IcedID has utilzed encrypted binaries and base64 encoded strings.^[96]

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.^[97]

IPsec Helper contains an embedded XML configuration file with an encrypted list of command and control servers. These are written to an external configuration file during execution.^[56]

IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.^[98]

Many strings in JHUHUGIT are obfuscated with a XOR algorithm.^[99][100][8]

Kapeka utilizes AES-256 (CBC mode), XOR, and RSA-2048 encryption schemas for various configuration and other objects.^[101]

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.^[102]

Kessel's configuration is hardcoded and RC4 encrypted within the binary.^[103]

Kevin has Base64-encoded its configuration file.^[104]

In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.^[105]

KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.^[55]

KGH_SPY has used encrypted strings in its installer.^[106]

KONNI is heavily obfuscated and includes encrypted configuration files.^[107]

Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.^[108]

Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.^{[109][110][111]}

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.^{[112][113][114][115][47][116][117]}

Leviathan has obfuscated code using base64.^[118]

LightNeuron encrypts its configuration files with AES-256.^[119]

LightSpy encrypts the C2 configuration file using AES with a static key, while the module .dylib files use a rolling one-byte encoding for obfuscation.^[120]

The LockBit 3.0 payload includes an encrypted main component.^[121][122]

LoudMiner has encrypted DMG files.^[123]

Lumma Stealer has used AES-encrypted payloads contained within PowerShell scripts.^[124]

LunarMail has used RC4 and AES to encrypt strings and its exfiltration configuration respectively.^[125]

The LunarWeb install files have been encrypted with AES-256.^[125]

Mafalda has been obfuscated and contains encrypted functions.^[126]

Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.^[127][128]

MagicRAT stores base64 encoded command and contorl URLs in a configuraiton file, with each URL prefixed with the value LR02DPt22R.^[129]

Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.^[130]

Mango contains a series of base64 encoded substrings.^[131]

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.^{[132][133][134]}

Metador has encrypted their payloads.^[126]

metaMain's module file has been encrypted via XOR.^[135]

Metamorfo has encrypted payloads and strings.^[136][137]

Micropsia obfuscates the configuration with a custom Base64 and XOR.^[138][139]

Milan can encode files containing information about the targeted system.^[140][104]

Mispadu uses a custom algorithm to obfuscate its internal strings and uses hardcoded keys.^[141]

Mispadu also uses encoded configuration files and has encoded payloads using Base64.^{[141][142][130]}

Mofang has encrypted payloads before they are downloaded to victims.^[143]

Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.^[144]

More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.^[145]

Moses Staff has used obfuscated web shells in their operations.^[54]

Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.^[146]

NanHaiShu encodes files in Base64.^[147]

During Night Dragon, threat actors used a DLL that included an XOR-encoded section.^[148]

The Ninja payload is XOR encrypted and compressed.^[149] Ninja has also XORed its configuration data with a constant value of 0xAA.^[150][149]

njRAT has included a base64 encoded executable.^[151]

OilRig has encrypted and encoded data in its malware, including by using base64.^{[152][153][154][155][156]}

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.^{[157][158][159][160]}

During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.^[161]

During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.^[162]

For Operation Spalax, the threat actors used XOR-encrypted payloads.^[163]

OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.^[164]

During Outer Space, OilRig deployed VBS droppers with obfuscated strings.^[131]

PcShare has been encrypted with XOR using different 32-long Base16 strings.^[41]

Penquin has encrypted strings in the binary for obfuscation.^[165]

PipeMon modules are stored encrypted on disk.^[166]

Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.^[167]

PS1 is distributed as a set of encrypted files and scripts.^[168]

Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.^[169]

PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.^[54]

Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.^{[170][171][172]}

Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.^[173][174]

RainyDay has downloaded as a XOR-encrypted payload.^[175]

RansomHub has an encrypted configuration file.^[176]

RAPIDPULSE has the ability to RC4 encrypt and base64 encode decrypted files on compromised servers prior to writing them to stdout.^[177]

Reaver encrypts some of its files with XOR.^[178]

Mustang Panda stored installation payloads as encrypted files in hidden folders during RedDelta Modified PlugX Infection Chain Operations.^[179]

A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.^[180]

Remexi obfuscates its configuration data with XOR.^[181]

Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.^[182][183]

REvil has used encrypted strings and configuration files.^{[184][185][186][187][188][189][190]}

Rifdoor has encrypted strings with a single byte XOR algorithm.^[94]

Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.^[191]

The ROADSWEEP binary contains RC4 encrypted embedded scripts.^{[192][193][194]}

Sagerunex can be passed a reference to an XOR-encrypted configuration file at runtime.^[195]

Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.^[196]

Sakula uses single-byte XOR obfuscation to obfuscate many of its files.^[197]

SamSam has been seen using AES or DES to encrypt payloads and payload components.^[198][199]

Seasalt obfuscates configuration data.^[200]

During ShadowRay, threat actors used Base64-encrypted Python code to evade detection.^[201]

Shark can use encrypted and encoded files for C2 configuration.^[140][202]

Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.^{[203][204][205]}

Skidmap has encrypted it's main payload using 3DES.^[206]

Sliver can encrypt strings at compile time.^[207][208]

Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.^[209][210]

SocGholish has single or double Base-64 encoded references to its second-stage server URLs.^[211]

SpeakUp encodes its second-stage payload with Base64. ^[212]

Squirrelwaffle has been obfuscated with a XOR-based algorithm.^[213][214]

STARWHALE has been obfuscated with hex-encoded strings.^[215]

StealBit stores obfuscated DLL file names in its executable.^[216]

StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.^[217]

Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.^[218]

StrelaStealer uses XOR-encoded strings to obfuscate items.^[219]

StrongPity has used encrypted strings in its dropper component.^[220][221]

Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.^[222]

SUPERNOVA contained Base64-encoded strings.^[223]

SysUpdate can encrypt and encode its configuration file.^[224]

TA2541 has used compressed and char-encoded scripts in operations.^[225]

TA505 has password-protected malicious Word documents.^[226]

Taidoor can use encrypted string blocks for obfuscation.^[227]

TeamTNT has encrypted its binaries via AES and encoded files using Base64.^[228][229]

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.^{[230][231][232]}

ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.^[233]

TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.^[234]

Torisma has been Base64 encoded and AES encrypted.^[160]

Transparent Tribe has dropped encoded executables on compromised hosts.^[235]

TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.^[236]

Tropic Trooper has encrypted configuration files.^[237][238]

APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.^[239]

UPSTYLE stores primary content as base64-encoded objects.^[240][241]

Uroburos can use AES and CAST-128 encryption to obfuscate resources.^[242]

Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.^[243] Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.^[244]

Most strings in USBStealer are encrypted using 3DES and XOR and reversed.^[245]

VERMIN is obfuscated using the obfuscation tool called ConfuserEx.^[246]

VersaMem encrypted captured credentials with AES then Base64 encoded them before writing to local storage.^[247]

A Volgmer variant is encoded using a simple XOR cipher.^[248]

The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.^[249]

Waterbear has used RC4 encrypted shellcode and encrypted functions.^[250]

WhisperGate can Base64 encode strings, store downloaded files in reverse byte order, and use the Eazfuscator tool to obfuscate its third stage.^{[251][252][253]}

Whitefly has encrypted the payload used for C2.^[254]

WindTail can be delivered as a compressed, encrypted, and encoded payload.^[255]

Winnti for Linux can encode its configuration file with single-byte XOR encoding.^[256]

Winnti for Windows has the ability to encrypt and compress its payload.^[257]

Woody RAT has used Base64 encoded strings and scripts.^[258]

Older XCSSET variants use xxd to encode modules. Later versions pass an xxd or base64 encoded blob through multiple decoding stages to reconstruct the module name, AppleScript, or shell command. For example, the initial network request uses three layers of hex decoding before executing a curl command in a shell.^[259]

XLoader features encrypted functions using the RC4 algorithm and bytecode operations.^[260][261]

YAHOYAH encrypts its configuration file using a simple algorithm.^[262]

ZeroT has encrypted its payload with RC4.^[263]

Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.^[264][265]

Zox has been encoded with Base64.^[266]

ZxxZ has been encoded to avoid detection from static analysis tools.^[267]

Anti-virus can be used to automatically detect and quarantine suspicious files, including those with high entropy measurements or with otherwise potentially malicious signs of obfuscation.

On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.^[268]

Security tools should be configured to analyze the encoding properties of files and detect anomalies that deviate from standard encoding practices.