Technique:  Obfuscated Files or Information
During the 2016 Ukraine Electric Power Attack, It used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.
Action RAT's commands, strings, and domains can be Base64 encoded within the payload.
Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.
Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.
Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.
Anchor has obfuscated code with stack strings and string encryption.
AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.
AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.
It has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.
It obfuscates strings in the payload.
It used Base64 to obfuscate payloads.
It encrypted a .dll payload using RTL and a custom encryption algorithm. It has also obfuscated payloads with base64, XOR, and RC4.
It obfuscates files or information to help evade defensive measures.
It has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). It also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.
It has used base64 to encode payloads.
It obfuscates strings and payloads.
It has used malware to drop encrypted CAB files.
It used VMProtected binaries in multiple intrusions.
Aria-body has used an encrypted configuration file for its loader.
Astaroth has used an XOR-based algorithm to encrypt payloads twice with different keys.
Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.
AuditCred encrypts the configuration.
Avaddon has used encrypted strings.
Avenger has the ability to XOR encrypt files to be sent to C2.
AvosLocker has used XOR-encoded strings.
It has obfuscated tools and malware it uses with VMProtect.
BADHATCH can be compressed with the ApLib algorithm.
Bazar has used XOR, RSA2, and RC4 encrypted files.
BendyBear has encrypted payloads using RC4 and XOR.
Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.
BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.
It has used a RAR SFX dropper to deliver malware.
It's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.
BLINDINGCAN has obfuscated code using Base64 encoding.
It has obfuscated the wallet address in the payload binary.
BLUELIGHT has a XOR-encoded payload.
BoomBox can encrypt data using AES prior to exfiltration.
BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.
BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.
Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.
Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.
Bundlore has obfuscated data with base64, AES, RC4, and bz2.
During C0015, the threat actors used Base64-encoded strings.
During C0017, It broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.
It encrypts strings to make analysis more difficult.
Carberp has used XOR-based encryption to mask C2 server locations within the trojan.
Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.
Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.
CARROTBALL has used a custom base64 alphabet to decode files.
CARROTBAT has the ability to download a base64 encoded payload.
Chinoxy has encrypted its configuration file.
Chrommme can encrypt sections of its code to evade detection.
The Clambling executable has been obfuscated when dropped on a compromised host.
Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.
CoinTicker initially downloads a hidden encoded file.
Comnie uses RC4 and Base64 to obfuscate strings.
ComRAT has encrypted its virtual file system using AES-256 in XTS mode.
Conficker has obfuscated its code to prevent its removal from host machines.
Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.
CORESHELL obfuscates strings using a custom stream cipher.
The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.
Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.
Dacls can encrypt its configuration file with AES CBC.
DanBot can Base64 encode its payload.
It has obfuscated strings in Bandook by base64 encoding, and then encrypting them.
It has obfuscated code using RC4, XOR, and RSA.
DarkTortilla has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.
DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.
Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.
DCSrv's configuration is encrypted.
DEADEYE has encrypted its payload.
Denis obfuscates its code and encrypts the API names.
Diavol has Base64 encoded the RSA public key used for encrypting files.
DOGCALL is encrypted using single-byte XOR.
Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.
DRATzarus can be partly encrypted with XOR.
Dridex's strings are obfuscated using RC4.
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.
The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.
It used Base64 to encode strings.
Ebury has obfuscated its strings with a simple XOR encryption with a static key.
ECCENTRICBANDWAGON has encrypted strings with RC4.
Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.
EKANS uses encoded strings in its process kill list.
It has encrypted documents and malicious executables.
Elise encrypts several of its files, including configuration files.
It has obfuscated malware to help avoid detection.
Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.
EnvyScout can Base64 encode payloads.
Epic heavily obfuscates its code to make analysis more difficult.
Exaramel for Linux uses RC4 for encrypting the configuration.
FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.
FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.
Final1stspy obfuscates strings with base64 encoding.
FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.
The FIVEHANDS payload is encrypted with AES-128.
Flagpro has been delivered within ZIP or RAR password-protected archived files.
FlawedGrace encrypts its C2 configuration files with AES in CBC mode.
FoggyWeb has been XOR-encoded.
It has base64 encoded payloads to avoid detection.
FunnyDream can Base64 encode its C2 address stored in a template binary with the xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_- orxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_= character sets.
Fysbis has been encrypted using XOR and RC4.
It used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.
It obfuscated shellcode used during execution.
It has delivered self-extracting 7z archive files within malicious document attachments.
Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.
Gelsemium has the ability to compress its components.
GoldenSpy's uninstaller has base64-encoded its variables.
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.
Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.
The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.
GravityRAT supports file encryption (AES with the key "lolomycin2017").
Green Lambert has encrypted strings.
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.
GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.
It disguised its malicious binaries with several layers of obfuscation, including encrypting the files.
H1N1 uses multiple techniques to obfuscate strings, including XOR.
Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.
HAWKBALL has encrypted the payload with an XOR-based algorithm.
The Helminth config file is encrypted with RC4.
HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.
HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.
Heyoka Backdoor can encrypt its payload.
Hi-Zor uses various XOR techniques to obfuscate its components.
HiddenWasp encrypts its configuration and payload.
It used Base64 encoded compressed payloads.
Hildegard has encrypted an ELF file.
Some strings in HOMEFRY are obfuscated with XOR x56.
HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.
HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.
Hydraq uses basic obfuscation in the form of spaghetti code.
HyperBro can be delivered encrypted to a compromised host.
IcedID has utilzed encrypted binaries and base64 encoded strings.
Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.
It has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.
InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.
IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.
ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.
Many strings in JHUHUGIT are obfuscated with a XOR algorithm.
A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.
jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.
Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.
It has used Base64-encoded shellcode strings.
Kerrdown can encrypt, encode, and compress multiple layers of shellcode.
Kessel's configuration is hardcoded and RC4 encrypted within the binary.
Kevin has Base64-encoded its configuration file.
In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.
KEYPLUG can use a hardcoded one-byte XOR encoded configuration file.
KGH_SPY has used encrypted strings in its installer.
KillDisk uses VMProtect to make reverse engineering the malware more difficult.
It has obfuscated binary strings including the use of XOR encryption and Base64 encoding. It has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.
Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.
KONNI is heavily obfuscated and includes encrypted configuration files.
Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.
It has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.
It has obfuscated code using base64 and gzip compression.
LightNeuron encrypts its configuration files with AES-256.
Lokibot has obfuscated strings with base64 encoding.
LoudMiner has encrypted DMG files.
Mafalda has been obfuscated and contains encrypted functions.
It malware has used base64-encoded files and has also encrypted embedded strings with AES.
Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.
Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.
MCMD can Base64 encode output strings prior to sending to C2.
It has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.
It has encrypted their payloads.
metaMain's module file has been encrypted via XOR.
Metamorfo has encrypted payloads and strings.
Micropsia obfuscates the configuration with a custom Base64 and XOR.
Milan can encode files containing information about the targeted system.
MiniDuke can use control flow flattening to obscure code.
It has compressed the ShimRat executable within malicious email attachments. It has also encrypted payloads before they are downloaded to victims.
It has delivered compressed executables within ZIP files to victims.
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.
It has used obfuscated web shells in their operations.
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.
It has delivered initial payloads hidden using archives and encoding measures.
NanHaiShu encodes files in Base64.
NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.
NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.
During Night Dragon, threat actors used a DLL that included an XOR-encoded section.
NightClub can obfuscate strings using the congruential generator (LCG): staten+1 = (690069 × staten + 1) mod 232.
njRAT has included a base64 encoded executable.
NOKKI uses Base64 encoding for strings.
It has encrypted and encoded data in its malware, including by using base64.
OLDBAIT obfuscates internal strings and unpacks them at startup.
OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.
During Operation Dream Job, It encrypted malware such as  DRATzarus with XOR and DLL files with base64.
During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.
During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.
For Operation Spalax, the threat actors used XOR-encrypted payloads.
Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.
OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.
Out1 has the ability to encode data.
P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.
Pandora has the ability to compress stings with QuickLZ.
PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.
Penquin has encrypted strings in the binary for obfuscation.
Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.
PipeMon modules are stored encrypted on disk.
Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.
PlugX can use API hashing and modify the names of strings to evade detection.
PoetRAT has used a custom encryption scheme for communication between scripts.
PoisonIvy hides any strings related to its own indicators of compromise.
PolyglotDuke can custom encrypt strings.
Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.
POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.
PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.
Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.
PS1 is distributed as a set of encrypted files and scripts.
PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.
PUNCHTRACK is loaded and executed by a highly obfuscated launcher.
Droppers used by It use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.
PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.
QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.
Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.
RainyDay has downloaded as a XOR-encrypted payload.
Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.
RCSession can compress and obfuscate its strings to evade detection on a compromised host.
Reaver encrypts some of its files with XOR.
A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.
RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.
Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.
Remexi obfuscates its configuration data with XOR.
Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.
REvil has used encrypted strings and configuration files.
Rifdoor has encrypted strings with a single byte XOR algorithm.
Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.
It has modified UPX headers after packing files to break unpackers.
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.
It strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. It has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.
Ryuk can use anti-disassembly and code transformation obfuscation techniques.
Saint Bot has been obfuscated to help avoid detection.
Sakula uses single-byte XOR obfuscation to obfuscate many of its files.
SamSam has been seen using AES or DES to encrypt payloads and payload components.
It has used Base64 encoding within malware variants.
Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.
SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.
Seasalt obfuscates configuration data.
ShadowPad has encrypted its payload, a virtual file system, and various files.
Shamoon contains base64-encoded strings.
Shark can use encrypted and encoded files for C2 configuration.
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.
ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.
It has used base64 encoding and ECDH-P256 encryption for payloads.
Siloscape itself is obfuscated and uses obfuscated API calls.
Skidmap has encrypted it's main payload using 3DES.
Sliver can encrypt strings at compile time.
Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.
Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.
Snip3 has the ability to obfuscate strings using XOR encryption.
SodaMaster can use "stackstrings" for obfuscation.
SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.
SoreFang has the ability to encode and RC6 encrypt data sent to C2.
SpeakUp encodes its second-stage payload with Base64.
Squirrelwaffle has been obfuscated with a XOR-based algorithm.
STARWHALE has been obfuscated with hex-encoded strings.
StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.
StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.
StrongPity has used encrypted strings in its dropper component.
Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.
SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.
SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe process.
SUPERNOVA contained Base64-encoded strings.
SVCReady can encrypt victim data with an RC4 cipher.
SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.
SysUpdate can encrypt and encode its configuration file.
It has used compressed and char-encoded scripts in operations.
It has password-protected malicious Word documents.
Taidoor can use encrypted string blocks for obfuscation.
TajMahal has used an encrypted Virtual File System to store plugins.
It has encrypted its binaries via AES and encoded files using Base64.
TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.
A It tool can encrypt payloads using XOR. It malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.
TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.
Torisma has been Base64 encoded and AES encrypted.
It has dropped encoded executables on compromised hosts.
TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.
It has encrypted configuration files.
Turian can use VMProtect for obfuscation.
APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.
UBoatRAT encrypts instructions in the payload using a simple XOR cipher.
Uroburos can use AES and CAST-128 encryption to obfuscate resources.
Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk. Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.
Most strings in USBStealer are encrypted using 3DES and XOR and reversed.
Valak has the ability to base64 encode and XOR encrypt strings.
VERMIN is obfuscated using the obfuscation tool called ConfuserEx.
A Volgmer variant is encoded using a simple XOR cipher.
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.
Waterbear has used RC4 encrypted shellcode and encrypted functions.
WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage.
It has encrypted the payload used for C2.
It has used string encoding with floating point calculations.
WindTail can be delivered as a compressed, encrypted, and encoded payload.
Winnti for Linux can encode its configuration file with single-byte XOR encoding.
Winnti for Windows has the ability to encrypt and compress its payload.
Woody RAT has used Base64 encoded strings and scripts.
A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.
YAHOYAH encrypts its configuration file using a simple algorithm.
ZeroT has encrypted its payload with RC4.
Zeus Panda encrypts strings with XOR. Zeus Panda also encrypts all configuration and settings in AES and RC4.
Zox has been encoded with Base64.
ZxxZ has been encoded to avoid detection from static analysis tools.