Deobfuscate/Decode Files or Information

ABK has the ability to decrypt AES encrypted payloads.^[4]

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.^[5]

AppleJeus has decoded files received from a C2.^[6]

AppleSeed can decode its payload prior to execution.^[7]

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[8]

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.^[9][10]

APT29 used 7-Zip to decode its Raindrop malware.^[11]

APT39 has used malware to decrypt encrypted CAB files.^[12]

Aria-body has the ability to decrypt the loader configuration and payload DLL.^[13]

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. ^[14][15]

AuditCred uses XOR and RC4 to perform decryption on the code functions.^[16]

Avaddon has decrypted encrypted strings.^[17]

Avenger has the ability to decrypt files downloaded from C2.^[4]

Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[18][19]

Babuk has the ability to unpack itself into memory using XOR.^[20][21]

BabyShark has the ability to decode downloaded files prior to execution.^[22]

BackConfig has used a custom routine to decrypt strings.^[23]

BADFLICK can decode shellcode using a custom rotating XOR cipher.^[24]

Bandook has decoded its PowerShell script.^[25]

Bankshot decodes embedded XOR strings.^[26]

Bazar can decrypt downloaded payloads. Bazar also resolves strings and API calls at runtime.^[27][28]

BBK has the ability to decrypt AES encrypted payloads.^[4]

BBSRAT uses Expand to decompress a CAB file into executable content.^[29]

BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.^[30]

Bisonal decodes strings in the malware using XOR and RC4.^[31]

BLINDINGCAN has used AES and XOR to decrypt its DLLs.^[32]

BoomBox can decrypt AES-encrypted files downloaded from C2.^[33]

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.^[34]

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[35]

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.^[36]

Carbon decrypts task and configuration files for execution.^[37][38]

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[39]

certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]

Chaes has decrypted an AES encrypted binary file to trigger the download of other files.^[40]

Clop has used a simple XOR operation to decrypt strings.^[41]

Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.^[42][43]

CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[44]

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.^[45][46]

Conti has decrypted its payload using a hardcoded AES-256 key.^[47][48]

CookieMiner has used Google Chrome's decryption and extraction operations.^[49]

CostaBricks has the ability to use bytecode to decrypt embedded payloads.^[50]

Crimson can decode its encoded PE file prior to execution.^[51]

Darkhotel has decrypted strings and imports using RC4 during execution.^[52][53]

DDKONG decodes an embedded configuration using XOR.^[54]

Denis will decrypt important strings used for C&C communication.^[55]

DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.^[56]

Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.^[57]

Dtrack has used a decryption routine that is part of an executable physical patch.^[58]

Dyre decrypts resources needed for targeting the victim.^[59][60]

Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.^[61]

Ecipekac has the ability to decrypt fileless loader modules.^[62]

Egregor has been decrypted before execution.^[63][64]

EnvyScout can deobfuscate and write malicious ISO files to disk.^[33]

Exaramel for Linux can decrypt its configuration file.^[65]

Expand can be used to decompress a local or remote CAB file into an executable.^[66]

FatDuke can decrypt AES encrypted C2 communications.^[67]

Final1stspy uses Python code to deobfuscate base64-encoded strings.^[68]

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[69][70]

FIVEHANDS has the ability to decrypt its payload prior to execution.^[71][72][73]

Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.^[74]

FYAnti has the ability to decrypt an embedded .NET module.^[62]

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.^[75][76]

gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.^[77]

GoldMax has decoded and decrypted the configuration file when executed.^[78][79]

Goopy has used a polymorphic decryptor to decrypt itself at runtime.^[55]

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[80]

Grandoreiro can decrypt its encrypted internal strings.^[81]

GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.^[82]

Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.^[83][84]

HiddenWasp uses a cipher to implement a decoding function.^[85]

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.^[86][87]

Hildegard has decrypted ELF files with AES.^[88]

Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.^[89]

Imminent Monitor has decoded malware components that are then dropped to the system.^[90]

Industroyer decrypts code to connect to a remote C2 server.^[91]

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.^[92][93]

IronNetInjector has the ability to decrypt embedded .NET and PE payloads.^[94]

ISMInjector uses the certutil command to decode a payload file.^[95]

Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.^[96]

Kessel has decrypted the binary's configuration once the main function was launched.^[97]

KGH_SPY can decrypt encrypted strings and write them to a newly created folder.^[98]

Kobalos decrypts strings right after the initial communication, but before the authentication process.^[99]

KONNI has used certutil to download and decode base64 encoded strings.^[100]

Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[101]

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[102]

LightNeuron has used AES and XOR to decrypt configuration files and commands.^[103]

LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.^[67]

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.^[104]

LookBack has a function that decrypts malicious data.^[105]

Lucifer can decrypt its C2 address upon execution.^[106]

Machete’s downloaded data is decrypted using AES.^[107]

MegaCortex has used a Base64 key to decode its components.^[108]

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.^[109][110]

After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. ^[111]

Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.^{[112][113][114]}

MirageFox has a function for decrypting data containing C2 configuration information.^[115]

Molerats decompresses ZIP files once on the victim machine.^[116]

More_eggs will decode malware components that are then dropped to the system.^[117]

MuddyWater decoded base64-encoded PowerShell commands using a VBS file.^{[118][119][120]}

NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.^[33]

Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.^[121]

NOKKI uses a unique, custom de-obfuscation technique.^[122]

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^{[123][95][124][125]}

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.^[126]

OnionDuke can use a custom decryption algorithm to decrypt strings.^[67]

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[124]

OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.^[127] Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.^[128][129]

P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.^[65]

Pillowmint has been decompressed by included shellcode prior to being launched.^[130]

PipeMon can decrypt password-protected executables.^[131]

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^[132]

PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.^[133]

PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.^[67]

POWERSTATS can deobfuscate the main backdoor code.^[120]

Proton uses an encrypted file to store commands and configuration values.^[134]

PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.^[50]

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.^[135]

QakBot can deobfuscate and re-assemble code strings for execution.^{[136][137][138]}

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[139]

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.^[11][140]

RainyDay can decrypt its payload via a XOR key.^[141]

Ramsay can extract its agent from the body of a malicious document.^[142]

RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.^[143]

RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.^[67]

Remexi decrypts the configuration data using XOR with 25-character keys.^[144]

REvil can decode encrypted strings to enable execution of commands and payloads.^{[145][146][147][148][149][150]}

RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[151]

Rising Sun decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.^[152]

Rocke has extracted tar.gz files after downloading them from a C2 server.^[153]

RogueRobin decodes an embedded executable using base64 and decompresses it.^[154]

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.^[155][156]

SDBbot has the ability to decrypt and decompress its payload to enable code execution.^[157][158]

ShadowPad has decrypted a binary blob to start execution.^[159]

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.^[160]

SharpStage has decompressed data received from the C2 server.^[161]

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.^[162]

Sibot can decrypt data received from a C2 and save to a file.^[78]

SideTwist can decode and decrypt messages received from C2.^[163]

Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.^[164]

Skidmap has the ability to download, unpack, and decrypt tar.gz files .^[165]

Smoke Loader deobfuscates its code.^[166]

SombRAT can run upload to decrypt and upload files from storage.^[50][72]

SoreFang can decode and decrypt exfiltrated data sent to C2.^[167]

Spark has used a custom XOR algorithm to decrypt the payload.^[168]

SQLRat has scripts that are responsible for deobfuscating additional scripts.^[169]

Starloader decrypts and executes shellcode from a file called Stars.jps.^[170]

Stuxnet decrypts resources that are loaded into memory and executed.^[171]

SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.^[172]

Taidoor can use a stream cipher to decrypt stings used by the malware.^[173]

TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.^{[174][175][140]}

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[176]

TrickBot decodes the configuration data and modules.^{[177][178][179]}

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.^[180][181]

TSCookie has the ability to decrypt, load, and execute a DLL and its resources.^[182]

Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.^[183]

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.^[184]

One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[185]

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.^[186]

Valak has the ability to decode and decrypt downloaded files.^[187][188]

VaporRage can deobfuscate XOR-encoded shellcode prior to execution.^[33]

VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[189]

Volgmer deobfuscates its strings and APIs once its executed.^[190]

WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.^[191]

Waterbear has the ability to decrypt its RC4 encrypted payload for execution.^[192]

WellMail can decompress scripts received from C2.^[193]

WellMess can decode and decrypt data received from C2.^{[194][195][196]}

WindTail has the ability to decrypt strings using hard-coded AES keys.^[197]

Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.^[198]

WIRTE has decoded a base64 encoded document which was embedded in a VBS script.^[199]

xCaon has decoded strings from the C2 server before executing commands.^[200]

YAHOYAH decrypts downloaded files before execution.^[201]

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.^[202][203]

ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[204]

Zeus Panda decrypts strings in the code during the execution process.^[205]

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.^[206]