sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
TA2541 has used a .NET packer to obfuscate malicious files.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
TA505 has used UPX to obscure malicious code.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
TeamTNT has used UPX and Ezuri packer to pack its binaries.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
The White Company has obfuscated their payloads through packing.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Threat Group-3390 has packed malware and tools, including using VMProtect.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
ZIRCONIUM has used multi-stage packers for exploit code.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Anchor has come with a packed payload.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
AppleSeed has used UPX packers for its payload DLL.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Astaroth uses a software packer called Pe123\RPolyCryptor.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
BLINDINGCAN has been packed with the UPX packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Versions of Babuk have been packed.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Bazar has a variant with a packed payload.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Bisonal has used the MPRESS packer and similar tools for obfuscation.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
The first stage of COATHANGER is delivered as a packed file.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
CSPY Downloader has been packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
China Chopper's client component is packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Clop has been packed to help avoid detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Cuba has a packed payload when delivered.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
DRATzarus's dropper can be packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
DarkComet has the option to compress its payload using UPX or MPRESS.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
A version of Daserf uses the MPRESS packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Dok is packed with an UPX executable packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Donut can generate packed code modules.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Dyre has been delivered with encrypted resources and must be unpacked for execution.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Emotet has used custom packers to protect its payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
FYAnti has used ConfuserEx to pack its .NET module.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
FatDuke has been regularly repacked by its operators to create large binaries and evade detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
A FinFisher variant uses a custom packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
GoldMax has been packed for obfuscation.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
GreyEnergy is packed for obfuscation.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
H1N1 uses a custom packing algorithm.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Hildegard has packed ELF files into other binaries.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
HotCroissant has used the open source UPX executable packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
HyperBro has the ability to pack its payload.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
IcedID has packed and encrypted its loader module.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
KONNI has been packed for obfuscation.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
LiteDuke has been packed with multiple layers of encryption.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Lokibot has used several packing methods for obfuscation.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Lucifer has used UPX packed binaries.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Machete has been packed with NSIS.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Melcoz has been packed with VMProtect and Themida.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Metamorfo has used VMProtect to pack and protect files.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Misdat was typically packed using UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Mongall has been packed with Themida.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
NETWIRE has used .NET packer tools to evade detection.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D has a variant that is packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
QakBot can encrypt and pack malicious payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Some S-Type samples have been packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
SDBbot has used a packed installer file.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Saint Bot has been packed using a dark market crypter.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
SeaDuke has been packed with the UPX packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Spark has been packed with Enigma Protector to obfuscate its contents.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Squirrelwaffle has been packed with a custom packer to hide payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
SysUpdate has been packed with VMProtect.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Tomiris has been packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Torisma has been packed with Iz4 compression.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
TrickBot leverages a custom packer to obfuscate its functionality.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Uroburos uses a custom packer.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
VERMIN is initially packed.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Valak has used packed DLL payloads.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Zebrocy's Delphi variant was packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
Some ZeroT DLL files have been packed with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
jRAT payloads have been packed.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
yty packs a plugin with UPX.
Technique: T1027.002 Obfuscated Files or Information: Software Packing, Tactic: TA0005 Defense Evasion
During Operation Ghost, APT29 used steganography to hide payloads inside valid images.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
APT37 uses steganography to send images to users that are embedded with shellcode.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Andariel has hidden malicious executables within PNG files.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Earth Lusca has used steganography to hide shellcode in a BMP image file.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Leviathan has used steganography to hide stolen data inside other files stored on Github.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
TA551 has hidden encoded data for malware DLLs in a PNG.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
ABK can extract a malicious Portable Executable (PE) from a photo.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Avenger can extract backdoor malware from downloaded images.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
BBK can extract a malicious Portable Executable (PE) from a photo.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Bandook has used .PNG images within a zip file to build the executable.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
IcedID has embedded binaries within RC4 encrypted .png files.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
LiteDuke has used image files to hide its loader component.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
ObliqueRAT can hide its payload in BMP images hosted on compromised websites.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
PolyglotDuke can use steganography to hide C2 information in images.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
ProLock can use .jpg and .bmp files to store its payload.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
RDAT can also embed data within a BMP image prior to exfiltration.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Ramsay has PE data embedded within JPEG files contained within Word documents.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
RegDuke can hide data in images, including use of the Least Significant Bit (LSB).
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
build_downer can extract malware from a downloaded JPEG.
Technique: T1027.003 Obfuscated Files or Information: Steganography, Tactic: TA0005 Defense Evasion
Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in `Microsoft.CSharp.CSharpCodeProvider` class.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
DarkWatchman has used the `csc.exe` tool to compile a C# executable.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
Samurai can compile and execute downloaded modules at runtime.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.
Technique: T1027.004 Obfuscated Files or Information: Compile After Delivery, Tactic: TA0005 Defense Evasion
During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
APT3 has been known to remove indicators of compromise from tools.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
GALLIUM ensured each payload had a unique hash, including by using different types of packers.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
InvisiMole has undergone regular technical improvements in an attempt to evade detection.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Penquin can remove strings from binaries.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
PowerSploit's `Find-AVSignature` AntivirusBypass module can be used to locate single byte anti-virus signatures.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
QakBot can make small changes to itself in order to change its checksum and hash value.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
Waterbear can scramble functions not to be executed again with random values.
Technique: T1027.005 Obfuscated Files or Information: Indicator Removal from Tools, Tactic: TA0005 Defense Evasion
APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.
Technique: T1027.006 Obfuscated Files or Information: HTML Smuggling, Tactic: TA0005 Defense Evasion
EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.
Technique: T1027.006 Obfuscated Files or Information: HTML Smuggling, Tactic: TA0005 Defense Evasion
QakBot has been delivered in ZIP files via HTML smuggling.
Technique: T1027.006 Obfuscated Files or Information: HTML Smuggling, Tactic: TA0005 Defense Evasion
Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
AvosLocker has used obfuscated API calls that are retrieved by their checksums.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
Bazar can hash then resolve API calls at runtime.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
Brute Ratel C4 can call and dynamically resolve hashed APIs.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
Pteranodon can use a dynamic Windows hashing algorithm to map API components.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
Samurai can encrypt API name strings with an XOR-based algorithm.
Technique: T1027.007 Obfuscated Files or Information: Dynamic API Resolution, Tactic: TA0005 Defense Evasion
macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.
Technique: T1027.008 Obfuscated Files or Information: Stripped Payloads, Tactic: TA0005 Defense Evasion
For C0021, the threat actors embedded a base64-encoded payload within a LNK file.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
BADHATCH has an embedded second stage DLL payload within the first stage of the malware.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
Dtrack has used a dropper that embeds an encrypted payload as extra data.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
Emotet has dropped an embedded executable at `%Temp%\setup.exe`.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
Invoke-PSImage can be used to embed payload data within a new image file.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
Netwalker's DLL has been embedded within the PowerShell script in hex format.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
The Uroburos Queue file contains embedded executable files along with key material, communication channels, and modes of operation.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.
Technique: T1027.009 Obfuscated Files or Information: Embedded Payloads, Tactic: TA0005 Defense Evasion
During C0018, the threat actors used Base64 to encode their PowerShell scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
During C0021, the threat actors used encoded PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
During Frankenstein, the threat actors ran encoded commands from the command line.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
During Operation CuckooBees, the threat actors executed an encoded VBScript file.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
APT19 used Base64 to obfuscate executed commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Aquatic Panda has encoded PowerShell commands in Base64.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Chimera has encoded PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Ember Bear has obfuscated malicious scripts to help avoid detection.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
FIN6 has used encoded PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Fox Kitten has base64 encoded scripts to avoid detection.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Gamaredon Group has used obfuscated or encrypted scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
HEXANE has used Base64-encoded scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Leafminer obfuscated scripts that were used on victim machines.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Magic Hound has used base64-encoded commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Patchwork has obfuscated a script with Crypto Obfuscator.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Sidewinder has used base64 encoding for scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Silence has used environment variable string substitution for obfuscation.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
TA505 has used base64 encoded PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
TA551 has used obfuscated variable names in a JavaScript configuration file.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Turla has used encryption (including salted 3DES via PowerSploit's `Out-EncryptedScript.ps1`), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Astaroth has obfuscated and randomized parts of the JScript code it is initiating.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
BADHATCH malicious PowerShell commands can be encoded with base64.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
BackConfig has used compressed and decimal encoded VBS scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
CARROTBAT has the ability to execute obfuscated commands on the infected host.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
CookieMiner has used base64 encoding to obfuscate scripts on the system.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
DarkWatchman has used Base64 to encode PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Denis has encoded its PowerShell commands in Base64.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Empire has the ability to obfuscate commands using `Invoke-Obfuscation`.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
FruitFly executes and stores obfuscated Perl scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
IceApple can use Base64 and "junk" JavaScript code to obfuscate information.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
KOCTOPUS has obfuscated scripts with the BatchEncryption tool.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
LoudMiner has obfuscated various scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.  POWERSTATS has used PowerShell code with custom string obfuscation
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
PoetRAT has `pyminifier` to obfuscate scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
PowerPunch can use Base64-encoded scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
QUADAGENT was likely obfuscated using `Invoke-Obfuscation`.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
QakBot can use obfuscated and encoded scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Sibot has obfuscated scripts used in execution.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Ursnif droppers execute base64 encoded PowerShell commands.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
Zeus Panda obfuscates the macro commands in its initial payload.
Technique: T1027.010 Obfuscated Files or Information: Command Obfuscation, Tactic: TA0005 Defense Evasion
During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
APT32's backdoor has stored its configuration in a registry key.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Turla has used the Registry to store encrypted and encoded payloads.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Some versions of Chaes stored its instructions (otherwise in a `instructions.ini` file) in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
ComRAT has stored encrypted orchestrator code and payloads in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Gelsemium can store its components in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including `%USERNAME%` and `ToolTech-RM`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Mosquito stores configuration values under the Registry key `HKCU\Software\Microsoft\[dllname]`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Pillowmint has stored a compressed payload in the Registry key `HKLM\SOFTWARE\Microsoft\DRM`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
PolyglotDuke can store encrypted JSON configuration files in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
QakBot can store its configuration information in a randomly named subkey under `HKCU\Software\Microsoft`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
REvil can save encryption parameters and system information in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
RegDuke can store its encryption key in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
ShadowPad maintains a configuration block and virtual file system in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Sibot has installed a second-stage script in the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot` registry key.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
SysUpdate can store its encoded configuration file within `Software\Classes\scConfig` in either `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
TYPEFRAME can install and store encrypted configuration data under the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll` and `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
TinyTurla can save its configuration parameters in the Registry.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Valak has the ability to store information regarding the C2 server and downloads in the Registry key `HKCU\Software\ApplicationContainer\Appsw64`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
Volgmer stores an encoded configuration file in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security`.
Technique: T1027.011 Obfuscated Files or Information: Fileless Storage, Tactic: TA0005 Defense Evasion
During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
During Night Dragon, threat actors used a DLL that included an XOR-encoded section.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group encrypted malware such as  DRATzarus with XOR and DLL files with base64.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
For Operation Spalax, the threat actors used XOR-encrypted payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT18 obfuscates strings in the payload.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT19 used Base64 to obfuscate payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT33 has used base64 to encode payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
APT39 has used malware to drop encrypted CAB files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
BITTER has used a RAR SFX dropper to deliver malware.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Blue Mockingbird has obfuscated the wallet address in the payload binary.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Darkhotel has obfuscated code using RC4, XOR, and RSA.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Elderwood has encrypted documents and malicious executables.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Fox Kitten has base64 encoded payloads to avoid detection.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Higaisa used Base64 encoded compressed payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Leviathan has obfuscated code using base64 and gzip compression.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion
Metador has encrypted their payloads.
Technique: T1027.013 Obfuscated Files or Information: Encrypted/Encoded File, Tactic: TA0005 Defense Evasion