Technique:  Deobfuscate
ABK has the ability to decrypt AES encrypted payloads.
Action RAT can use Base64 to decode actor-controlled C2 server communications.
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.
Amadey has decoded antivirus name strings.
AppleJeus has decoded files received from a C2.
AppleSeed can decode its payload prior to execution.
An It HTTP malware variant decrypts strings using single-byte XOR keys.
An It macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
It has used malware to decrypt encrypted CAB files.
Aria-body has the ability to decrypt the loader configuration and payload DLL.
Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.
AuditCred uses XOR and RC4 to perform decryption on the code functions.
Avaddon has decrypted encrypted strings.
Avenger has the ability to decrypt files downloaded from C2.
AvosLocker has deobfuscated XOR-encoded strings.
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.
Babuk has the ability to unpack itself into memory using XOR.
BabyShark has the ability to decode downloaded files prior to execution.
BackConfig has used a custom routine to decrypt strings.
BADFLICK can decode shellcode using a custom rotating XOR cipher.
Bandook has decoded its PowerShell script.
Bankshot decodes embedded XOR strings.
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.
BBK has the ability to decrypt AES encrypted payloads.
BBSRAT uses Expand to decompress a CAB file into executable content.
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.
Bisonal has decoded strings in the malware using XOR and RC4.
BLINDINGCAN has used AES and XOR to decrypt its DLLs.
BoomBox can decrypt AES-encrypted files downloaded from C2.
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.
It downloads encoded payloads and decodes them on the victim.
Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.
Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.
During C0017, It used the DUSTPAN loader to decrypt embedded payloads.
During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string 'FromBase'+0x40+'String', in place of FromBase64String which is normally used to decode base64.
Carbon decrypts task and configuration files for execution.
Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.
certutil has been used to decode binaries hidden inside certificate files as Base64 information.
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.
CharmPower can decrypt downloaded modules prior to execution.
The Chinoxy dropping function can initiate decryption of its config file.
Chrommme can decrypt its encrypted internal code.
Clambling can deobfuscate its payload prior to execution.
Clop has used a simple XOR operation to decrypt strings.
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.
Conti has decrypted its payload using a hardcoded AES-256 key.
CookieMiner has used Google Chrome's decryption and extraction operations.
CostaBricks has the ability to use bytecode to decrypt embedded payloads.
Crimson can decode its encoded PE file prior to execution.
Cyclops Blink can decrypt and parse instructions sent from C2.
DanBot can use a VBA macro to decode its payload prior to installation and execution.
It has decrypted strings and imports using RC4 during execution.
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.
DarkWatchman has the ability to self-extract as a RAR archive.
DDKONG decodes an embedded configuration using XOR.
DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.
Denis will decrypt important strings used for C&C communication.
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.
Dtrack has used a decryption routine that is part of an executable physical patch.
Dyre decrypts resources needed for targeting the victim.
It has used certutil to decode a string into a cabinet file.
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.
Ecipekac has the ability to decrypt fileless loader modules.
Egregor has been decrypted before execution.
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.
EnvyScout can deobfuscate and write malicious ISO files to disk.
Exaramel for Linux can decrypt its configuration file.
Expand can be used to decompress a local or remote CAB file into an executable.
FatDuke can decrypt AES encrypted C2 communications.
It has utilized certutil to decode base64 encoded versions of custom malware.
Final1stspy uses Python code to deobfuscate base64-encoded strings.
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.
FIVEHANDS has the ability to decrypt its payload prior to execution.
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.
During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
FYAnti has the ability to decrypt an embedded .NET module.
It tools decrypted additional payloads from the C2. It has also decoded base64-encoded source code of a downloader.
Gelsemium can decompress and decrypt DLLs and shellcode.
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.
GoldMax has decoded and decrypted the configuration file when executed.
Goopy has used a polymorphic decryptor to decrypt itself at runtime.
It malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
Grandoreiro can decrypt its encrypted internal strings.
Green Lambert can use multiple custom routines to decrypt strings prior to execution.
GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.
HermeticWiper can decompress and copy driver files using LZCopy.
Heyoka Backdoor can decrypt its payload prior to execution.
HiddenWasp uses a cipher to implement a decoding function.
It used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
Hildegard has decrypted ELF files with AES.
HyperBro can unpack and decrypt its payload prior to execution.
IceApple can use a Base64-encoded AES key to decrypt tasking.
Imminent Monitor has decoded malware components that are then dropped to the system.
Industroyer decrypts code to connect to a remote C2 server.
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.
ISMInjector uses the certutil command to decode a payload file.
It has deobfuscated Base64-encoded shellcode strings prior to loading them.
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.
Kessel has decrypted the binary's configuration once the main function was launched.
KEYPLUG can decode its configuration file to determine C2 protocols.
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.
It has decoded malicious VBScripts using Base64.
Kobalos decrypts strings right after the initial communication, but before the authentication process.
KOCTOPUS has deobfuscated itself before executing its commands.
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.
It has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.
It has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.
LightNeuron has used AES and XOR to decrypt configuration files and commands.
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.
Lizar can decrypt its configuration data.
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.
LookBack has a function that decrypts malicious data.
Lucifer can decrypt its C2 address upon execution.
It’s downloaded data is decrypted using AES.
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.
Mafalda can decrypt files and data.
MegaCortex has used a Base64 key to decode its components.
It has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.
metaMain can decrypt and load other modules.
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.
MirageFox has a function for decrypting data containing C2 configuration information.
It decompresses ZIP files once on the victim machine.
Mongall has the ability to decrypt its payload prior to execution.
More_eggs will decode malware components that are then dropped to the system.
Mori can resolve networking APIs from strings that are ADD-encrypted.
It decoded base64-encoded PowerShell commands using a VBS file.
NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.
NOKKI uses a unique, custom de-obfuscation technique.
A It macro has run a PowerShell command to decode file contents. It has also used certutil to decode base64-encoded files on victims.
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.
OnionDuke can use a custom decryption algorithm to decrypt strings.
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.
During Operation Dust Storm, attackers used VBS code to decode payloads.
During Operation Honeybee, malicious files were decoded prior to execution.
For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.
OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the rotate function in reporting.
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.
Pillowmint has been decompressed by included shellcode prior to being launched.
PingPull can decrypt received data from its C2 server by using AES.
PipeMon can decrypt password-protected executables.
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.
POWERSTATS can deobfuscate the main backdoor code.
PowGoop can decrypt PowerShell scripts for execution.
Proton uses an encrypted file to store commands and configuration values.
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.
Pteranodon can decrypt encrypted data strings prior to using them.
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.
PyDCrypt has decrypted and dropped the DCSrv payload to disk.
QakBot can deobfuscate and re-assemble code strings for execution.
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.
QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.
RainyDay can decrypt its payload via a XOR key.
Ramsay can extract its agent from the body of a malicious document.
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.
Remexi decrypts the configuration data using XOR with 25-character keys.
REvil can decode encrypted strings to enable execution of commands and payloads.
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.
Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.
It has extracted tar.gz files after downloading them from a C2 server.
RogueRobin decodes an embedded executable using base64 and decompresses it.
ROKRAT can decrypt strings using the victim's hostname as the key.
RotaJakiro uses the AES algorithm, bit shifts in a function called rotate, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the head and key sections in the network packet structure used for C2 communications.
Saint Bot can deobfuscate strings and files for execution.
It's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.
Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.
SDBbot has the ability to decrypt and decompress its payload to enable code execution.
ShadowPad has decrypted a binary blob to start execution.
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.
Shark can extract and decrypt downloaded .zip files.
SharpStage has decompressed data received from the C2 server.
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.
Sibot can decrypt data received from a C2 and save to a file.
SideTwist can decode and decrypt messages received from C2.
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.
Skidmap has the ability to download, unpack, and decrypt tar.gz files .
Smoke Loader deobfuscates its code.
Snip3 can decode its second-stage PowerShell script prior to execution.
During the SolarWinds Compromise, It used 7-Zip to decode their Raindrop malware.
SombRAT can run upload to decrypt and upload files from storage.
SoreFang can decode and decrypt exfiltrated data sent to C2.
Spark has used a custom XOR algorithm to decrypt the payload.
SQLRat has scripts that are responsible for deobfuscating additional scripts.
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.
Starloader decrypts and executes shellcode from a file called Stars.jps.
Stuxnet decrypts resources that are loaded into memory and executed.
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.
SysUpdate can deobfuscate packed binaries in memory.
It has decrypted packed DLLs with an XOR key.
Taidoor can use a stream cipher to decrypt stings used by the malware.
It has used a script that decodes a Base64-encoded version of WeaveWorks Scope.
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.
During execution, It malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.
ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.
Torisma has used XOR and Base64 to decode C2 data.
TrickBot decodes the configuration data and modules.
It used shellcode with an XOR algorithm to decrypt a payload. It also decrypted image files which contained a payload.
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.
It has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".
Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.
Valak has the ability to decode and decrypt downloaded files.
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.
Volgmer deobfuscates its strings and APIs once its executed.
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.
WellMail can decompress scripts received from C2.
WellMess can decode and decrypt data received from C2.
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.
WindTail has the ability to decrypt strings using hard-coded AES keys.
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.
The Winnti for Windows dropper can decrypt and decompresses a data blob.
It has used Base64 to decode malicious VBS script.
Woody RAT can deobfuscate Base64-encoded strings and scripts.
xCaon has decoded strings from the C2 server before executing commands.
YAHOYAH decrypts downloaded files before execution.
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.
Zeus Panda decrypts strings in the code during the execution process.
ItM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.
ZxxZ has used a XOR key to decrypt strings.