Deobfuscate/Decode Files or Information

ABK has the ability to decrypt AES encrypted payloads.^[4]

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.^[5]

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.^[6]

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.^[7][8]

Aria-body has the ability to decrypt the loader configuration and payload DLL.^[9]

Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. ^[10]

AuditCred uses XOR and RC4 to perform decryption on the code functions.^[11]

Avenger has the ability to decrypt files downloaded from C2.^[4]

Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.^[12][13]

BackConfig has used a custom routine to decrypt strings.^[14]

Bankshot decodes embedded XOR strings.^[15]

BBK has the ability to decrypt AES encrypted payloads.^[4]

BBSRAT uses Expand to decompress a CAB file into executable content.^[16]

Bisonal decodes strings in the malware using XOR and RC4.^[17]

BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.^[18]

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.^[19]

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.^[20]

Carbon decrypts task and configuration files for execution.^[21]

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.^[22]

certutil has been used to decode binaries hidden inside certificate files as Base64 information.^[1]

CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.^[23]

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.^[24]

CookieMiner has used Google Chrome's decryption and extraction operations.^[25]

Darkhotel has decrypted strings and imports using RC4 during execution.^[26]

DDKONG decodes an embedded configuration using XOR.^[27]

Denis will decrypt important strings used for C&C communication.^[28]

Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.^[29]

Dyre decrypts resources needed for targeting the victim.^[30][31]

Expand can be used to decompress a local or remote CAB file into an executable.^[32]

FatDuke can decrypt AES encrypted C2 communications.^[33]

Final1stspy uses Python code to deobfuscate base64-encoded strings.^[34]

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.^[35][36]

Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.^[37]

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.^[38][39]

gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.^[40]

Goopy has used a polymorphic decryptor to decrypt itself at runtime.^[28]

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.^[41]

Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.^[42][43]

HiddenWasp uses a cipher to implement a decoding function.^[44]

Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.^[45]

Imminent Monitor has decoded malware components that are then dropped to the system.^[46]

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.^[47][48]

ISMInjector uses the certutil command to decode a payload file.^[49]

Kessel has decrypted the binary's configuration once the main function was launched.^[50]

KONNI has used certutil to download and decode base64 encoded strings.^[51]

Kwampirs decrypts and extracts a copy of its main DLL payload when executing.^[52]

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.^[53]

LightNeuron has used AES and XOR to decrypt configuration files and commands.^[54]

Machete’s downloaded data is decrypted using AES.^[55]

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.^[56][57]

After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. ^[58]

Upon execution, Metamorfo has unzipped itself after being downloaded to the system.^[59][60]

MirageFox has a function for decrypting data containing C2 configuration information.^[61]

Molerats decompresses ZIP files once on the victim machine.^[62]

More_eggs will decode malware components that are then dropped to the system.^[63]

MuddyWater decoded base64-encoded PowerShell commands using a VBS file.^[64][65][66]

Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.^[67]

NOKKI uses a unique, custom de-obfuscation technique.^[68]

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.^[69][49][70]

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.^[71]

OnionDuke can use a custom decryption algorithm to decrypt strings.^[33]

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.^[70]

OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.^[72]

Pillowmint has been decompressed by included shellcode prior to being launched.^[73]

PipeMon can decrypt password-protected executables.^[74]

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.^[75]

PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.^[33]

POWERSTATS can deobfuscate the main backdoor code.^[66]

Proton uses an encrypted file to store commands and configuration values.^[76]

PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.^[77]

QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.^[78]

Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.^[79][80]

Ramsay can extract its agent from the body of a malicious document.^[81]

RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.^[82]

RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.^[33]

Remexi decrypts the configuration data using XOR with 25-character keys.^[83]

REvil can decode encrypted strings to enable execution of commands and payloads.^{[84][85][86][87][88][89]}

RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.^[90]

Rising Sun decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.^[91]

Rocke has extracted tar.gz files after downloading them from a C2 server.^[92]

RogueRobin decodes an embedded executable using base64 and decompresses it.^[93]

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.^[94][95]

SDBot has the ability to decrypt and decompress its payload to enable code execution.^[96][97]

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.^[98]

ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.^[99]

Skidmap has the ability to download, unpack, and decrypt tar.gz files .^[100]

Smoke Loader deobfuscates its code.^[101]

SoreFang can decode and decrypt exfiltrated data sent to C2.^[102]

SQLRat has scripts that are responsible for deobfuscating additional scripts.^[103]

Starloader decrypts and executes shellcode from a file called Stars.jps.^[104]

Sunspot decrypts Sunburst, which was stored in AES128-CBC encrypted blobs.^[105]

Teardrop was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.^{[106][107][80]}

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[108]

TrickBot decodes the configuration data and modules.^[109][110]

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.^[111][112]

TSCookie has the ability to decrypt, load, and execute a DLL and its resources.^[113]

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.^[114]

One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".^[115]

UNC2452 used 7-Zip to decode its Raindrop malware.^[79]

Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.^[116]

Valak has the ability to decode and decrypt downloaded files.^[117][118]

VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.^[119]

Volgmer deobfuscates its strings and APIs once its executed.^[120]

WellMail can decompress scripts received from C2.^[121]

WellMess can decode and decrypt data received from C2.^{[122][123][124]}

WindTail has the ability to decrypt strings using hard-coded AES keys.^[125]

Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.^[126]

WIRTE has decoded a base64 encoded document which was embedded in a VBS script.^[127]

YAHOYAH decrypts downloaded files before execution.^[128]

Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.^[129][130]

ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.^[131]

Zeus Panda decrypts strings in the code during the execution process.^[132]