Procedure examples

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.

Sibot has obfuscated scripts used in execution.

BackConfig has used compressed and decimal encoded VBS scripts.

PHASEJAM has encoded commands with Base64.

PoetRAT has `pyminifier` to obfuscate scripts.

PowerPunch can use Base64-encoded scripts.

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. POWERSTATS has used PowerShell code with custom string obfuscation

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.

QakBot can use obfuscated and encoded scripts.

CookieMiner has used base64 encoding to obfuscate scripts on the system.

Denis has encoded its PowerShell commands in Base64.

LoudMiner has obfuscated various scripts.

XORIndex Loader has obfuscated strings using ASCII buffers and TextDecoder.

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.

Empire has the ability to obfuscate commands using Invoke-Obfuscation.

Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.

ThreatNeedle can save its configuration data as a RC4-encrypted Registry key under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.

NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

TinyTurla can save its configuration parameters in the Registry.

PolyglotDuke can store encrypted JSON configuration files in the Registry.

RegDuke can store its encryption key in the Registry.

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.

Some versions of Chaes stored its instructions (otherwise in a `instructions.ini` file) in the Registry.

TYPEFRAME can install and store encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.

QUADAGENT stores a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications within a Registry key (such as `HKCU\Office365DCOMCheck`) in the `HKCU` hive.

Uroburos can store configuration information for the kernel driver and kernel driver loader components in an encrypted blob typically found at `HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds.`

PipeMon has stored its encrypted payload in the Registry under `HKLM\SOFTWARE\Microsoft\Print\Components\`.

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].

Grandoreiro can store its configuration in the Registry at `HKCU\Software\` under frequently changing names including %USERNAME% and ToolTech-RM.

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

REvil can save encryption parameters and system information in the Registry.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Pillowmint has stored a compressed payload in the Registry key HKLM\SOFTWARE\Microsoft\DRM.

SysUpdate can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.

ComRAT has stored encrypted orchestrator code and payloads in the Registry.

ShadowPad maintains a configuration block and virtual file system in the Registry.

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Gelsemium can store its components in the Registry.

TONESHELL has been initiated using LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

BLINDINGCAN has obfuscated code using Base64 encoding.

The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA`.