Procedure examples

APT38 has used the RC4 algorithm to decrypt configuration data.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

Kimsuky has decoded malicious VBScripts using Base64. Kimsuky has also decoded malicious PowerShell scripts using Base64. Kimsuky has decoded RC4 obfuscated files prior to downloading files from their infrastructure.

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

FIN7 has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated block of data with the key `qawsed1q2w3e`, which led to the installation of Lizar.

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.

Rocke has extracted tar.gz files after downloading them from a C2 server.

APT39 has used malware to decrypt encrypted CAB files.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.

TA505 has decrypted packed DLLs with an XOR key.

Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

Darkhotel has decrypted strings and imports using RC4 during execution.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Malteiro has the ability to deobfuscate downloaded files prior to execution.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Earth Lusca has used certutil to decode a string into a cabinet file.

Molerats decompresses ZIP files once on the victim machine.

Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.

WIRTE has used Base64 to decode malicious VBS script.

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.

FIN13 has utilized `certutil` to decode base64 encoded versions of custom malware.

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.