Obfuscated Files or Information

Agent Smith’s core malware is disguised as a JPG file, and encrypted with an XOR cipher.^[5]

BrainTest stores a secondary Android app package (APK) in its assets directory in encrypted form, and decrypts the payload at runtime.^[6]

Bread uses various tricks to obfuscate its strings including standard and custom encryption, programmatically building strings at runtime, and splitting unencrypted strings with repeated delimiters to break up keywords. Bread has also abused Java and JavaScript features to obfuscate code. Bread payloads have used several commercially available packers as well as hiding code in native libraries and encrypted JAR files in the data section of an ELF file. Bread has stored DEX payloads as base64-encoded strings in the Android manifest and internal Java classes.^[7][8]

Cerberus uses standard payload and string obfuscation techniques.^[9]

Charger encodes strings into binary arrays to make it difficult to inspect them. It also loads code from encrypted resources dynamically and includes meaningless commands that mask the actual commands passing through.^[10]

Dvmap decrypts executables from archive files stored in the assets directory of the installation binary.^[11]

EventBot dynamically loads its malicious functionality at runtime from an RC4-encrypted TTF file. EventBot also utilizes ProGuard to obfuscate the generated APK file.^[12]

FakeSpy stores its malicious code in encrypted asset files that are decrypted at runtime. Newer versions of FakeSpy encrypt the C2 address.^[13]

FlexiSpy encrypts its configuration file using AES.^[14]

Ginp obfuscates its payload, code, and strings.^[15]

GolfSpy encodes its configurations using a customized algorithm.^[16]

Gustuff code is both obfuscated and packed with an FTT packer. Command information is obfuscated using a custom base85-based encoding.^[17]

INSOMNIA obfuscates various pieces of information within the application.^[18]

Mandrake obfuscates its hardcoded C2 URLs.^[19]

Monokle uses XOR to obfuscate its second stage binary.^[20]

OBAD contains encrypted code along with an obfuscated decryption routine to make it difficult to analyze.^[3]

Pallas stores domain information and URL paths as hardcoded AES-encrypted, base64-encoded strings.^[21]

Starting in 2017, the Rotexy DEX file was packed with garbage strings and/or operations.^[22]

TrickMo contains obfuscated function, class, and variable names, and encrypts its shared preferences using Java’s PBEWithMD5AndDES algorithm.^[23]

WireLurker obfuscates its payload through complex code structure, multiple component versions, file hiding, code obfuscation and customized encryption to thwart anti-reversing.^[24]

WolfRAT’s code is obfuscated.^[25]

XLoader for Android loads an encrypted DEX code payload.^[26]

Zen base64 encodes one of the strings it searches for.^[27]

Application vetting techniques may be able to alert to the presence of obfuscated or encrypted code in applications, and such applications could have extra scrutiny applied. Unfortunately, this mitigation is likely impractical, as many legitimate applications apply code obfuscation or encryption to resist adversary techniques such as Repackaged Application. Dynamic analysis when used in application vetting may in some cases be able to identify malicious code in obfuscated or encrypted form by detecting the code at execution time (after it is deobfuscated or decrypted). Some application vetting techniques apply reputation analysis of the application developer and can alert to potentially suspicious applications without actual examination of application code.