{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1140","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"7f3702a56c31f2db9bc1fa893d335b765574daa7e98177ec09b818772991483d","description":"Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> or <code>type</code> command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1140","external_id":"T1140"},{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"},{"source_name":"Sentinel One Tainted Love 2023","description":"Aleksandar Milenkoski, Juan Andres Guerrero-Saade, and Joey Chen. (2023, March 23). Operation Tainted Love | Chinese APTs Target Telcos in New Attacks. Retrieved March 18, 2025.","url":"https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/"},{"source_name":"Malwarebytes Targeted Attack against Saudi Arabia","description":"Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.","url":"https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"},{"source_name":"Carbon Black Obfuscation Sept 2016","description":"Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.","url":"https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1140","technique_page":"techniques/enterprise/T1140/","page":"detections/enterprise/T1140/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"ceb55fd0-726e-4656-bf4e-b585b7f7d572","title":"Suspicious Inbox Manipulation Rules","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/ceb55fd0-726e-4656-bf4e-b585b7f7d572.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"ba592c6d-6888-43c3-b8c6-689b8fe47337","title":"Linux Base64 Encoded Pipe to Shell","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/ba592c6d-6888-43c3-b8c6-689b8fe47337.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml","author":"pH-T (Nextron Systems)","kind":"sigma"},{"id":"fe2f9663-41cb-47e2-b954-8a228f3b9dff","title":"Linux Base64 Encoded Shebang In CLI","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/fe2f9663-41cb-47e2-b954-8a228f3b9dff.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"880973f3-9708-491c-a77b-2a35a1921158","title":"Linux Shell Pipe to Shell","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/880973f3-9708-491c-a77b-2a35a1921158.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/234dc5df-40b5-49d1-bf53-0d44ce778eca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"09a910bf-f71f-4737-9c40-88880ba5913d","title":"Potential Base64 Decoded From Images","status":"test","level":"high","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/09a910bf-f71f-4737-9c40-88880ba5913d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"1ddc1472-8e52-4f7d-9f11-eab14fc171f5","title":"PowerShell Decompress Commands","status":"test","level":"informational","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/1ddc1472-8e52-4f7d-9f11-eab14fc171f5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"cc7abbd0-762b-41e3-8a26-57ad50d2eea3","title":"MSHTA Execution with Suspicious File Extensions","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cc7abbd0-762b-41e3-8a26-57ad50d2eea3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml","author":"Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1a0d4aba-7668-4365-9ce4-6d79ab088dfd","title":"Ping Hex IP","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1a0d4aba-7668-4365-9ce4-6d79ab088dfd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c","title":"PowerShell Base64 Encoded FromBase64String Cmdlet","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"e32d4572-9826-4738-b651-95fa63747e8a","title":"Base64 Encoded PowerShell Command Detected","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e32d4572-9826-4738-b651-95fa63747e8a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","title":"Suspicious XOR Encoded PowerShell Command","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bb780e0c-16cf-4383-8383-1e5471db6cf9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml","author":"Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali","kind":"sigma"},{"id":"f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd","title":"Potential Commandline Obfuscation Using Escape Characters","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml","author":"juju4","kind":"sigma"},{"id":"04b45a8a-d11d-49e4-9acc-4a1b524407a5","title":"DNS-over-HTTPS Enabled by Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/04b45a8a-d11d-49e4-9acc-4a1b524407a5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml","author":"Austin Songer","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0275","name":"Detect Adversary Deobfuscation or Decoding of Files and Payloads","url":"https://attack.mitre.org/detectionstrategies/DET0275","stix_id":"x-mitre-detection-strategy--5b3bf2de-d91e-4272-97a8-5df6f4071e45","relationship_id":"relationship--9c92cb61-d6a7-4dc3-9bf8-1ebcc1b2cc73","description":"","analytics":[{"id":"AN0767","name":"Analytic 0767","guidance":"An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0767","platforms":["Windows"],"tuning":[{"field":"ToolName","description":"May vary across environments (e.g., certutil, powershell, copy, expand, 7zip)"},{"field":"FileExtensionFilter","description":"Targets may use .txt, .cer, .enc, .b64, .zip, etc. to disguise payloads"},{"field":"CommandLineRegex","description":"Command syntax varies between base64 decoding, copy /b, and expand switches"},{"field":"TimeWindow","description":"Deobfuscation typically follows staging/download within a short timeframe"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0767","source_url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0767","source_url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0767","source_url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0767","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN0768","name":"Analytic 0768","guidance":"The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0768","platforms":["Linux"],"tuning":[{"field":"ShellProcessName","description":"Shell interpreter may vary (bash, zsh, dash, sh)"},{"field":"DecodeUtility","description":"May include base64, openssl, gunzip, tar, uudecode"},{"field":"ParentProcess","description":"Expected parent process may vary in attacker chain (e.g., curl, bash, ssh)"},{"field":"ArgumentPattern","description":"Detection regex should support flexible patterning of decode switches"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"bash/zsh of base64, tar, gzip, or openssl immediately after file write","platforms":["Linux"],"analytic_id":"AN0768","source_url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0768","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0769","name":"Analytic 0769","guidance":"The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0769","platforms":["macOS"],"tuning":[{"field":"DecodeInterpreter","description":"Could involve base64, osascript, python, perl, or plutil"},{"field":"ExecutionContext","description":"Deobfuscation may happen within GUI app context or LaunchAgent/Daemon"},{"field":"UserContext","description":"May differ depending on local user, root escalation, or persistence method"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"base64 -d or osascript invoked on staged file","platforms":["macOS"],"analytic_id":"AN0769","source_url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0769","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0160","name":"certutil","page":"tools/S0160/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0361","name":"Expand","page":"tools/S0361/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0160","name":"certutil","page":"tools/S0160/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0361","name":"Expand","page":"tools/S0361/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0581","name":"IronNetInjector","page":"tools/S0581/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can use a stream cipher to decrypt stings used by the malware.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--5b928b39-ce48-47b8-82bc-d4ec63b1e3f4","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.(Citation: CIRCL PlugX March 2013)(Citation: Trend Micro DRBControl February 2020)(Citation: Proofpoint TA416 Europe March 2022) [PlugX](https://attack.mitre.org/software/S0013) has also decrypted its payloads in memory.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: Sophos Mustang Panda PLUGX)","relationship_id":"relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"EclecticIQ Mustang Panda PlugX","description":"EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025.","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--d1b6a397-4f29-4274-8394-1d5ca4fe9fc7","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0024","name":"Dyre","url":"https://attack.mitre.org/software/S0024","kind":"malware","description":"[Dyre](https://attack.mitre.org/software/S0024) decrypts resources needed for targeting the victim.(Citation: Symantec Dyre June 2015)(Citation: Malwarebytes Dyreza November 2015)","relationship_id":"relationship--6d1074cb-a9eb-4237-b8b2-d823cfa1408b","references":[{"source_name":"Symantec Dyre June 2015","description":"Symantec Security Response. (2015, June 23). Dyre: Emerging threat on financial fraud landscape. Retrieved August 23, 2018.","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf"},{"source_name":"Malwarebytes Dyreza November 2015","description":"hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has decrypted and loaded the [gh0st RAT](https://attack.mitre.org/software/S0032) DLL into memory, once the initial dropper executable is launched.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--8631491d-bda8-4eee-93ec-5f3fc6340c3f","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0052","name":"OnionDuke","url":"https://attack.mitre.org/software/S0052","kind":"malware","description":"[OnionDuke](https://attack.mitre.org/software/S0052) can use a custom decryption algorithm to decrypt strings.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--e1fba82d-1cd2-4906-92db-ba3aafad72ca","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) can decode its encoded PE file prior to execution.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--4ffef54e-be6b-40cf-9446-d886f298d79c","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. [ComRAT](https://attack.mitre.org/software/S0126) has also used a unique password to decrypt the file used for its hidden file system.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)","relationship_id":"relationship--ad8fdfa4-5e0b-437d-9723-9bc5a272f465","references":[{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source_name":"CISA ComRAT Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"}]},{"id":"S0127","name":"BBSRAT","url":"https://attack.mitre.org/software/S0127","kind":"malware","description":"[BBSRAT](https://attack.mitre.org/software/S0127) uses [Expand](https://attack.mitre.org/software/S0361) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)","relationship_id":"relationship--128e8365-7645-41fa-832e-5ff4d8639035","references":[{"source_name":"Palo Alto Networks BBSRAT","description":"Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) decrypts ciphertext using an XOR cipher and a base64-encoded string.(Citation: Unit 42 Shamoon3 2018)\t","relationship_id":"relationship--8fe32611-4206-4bef-9698-dbcefde08090","references":[{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"The [Winnti for Windows](https://attack.mitre.org/software/S0141) dropper can decrypt and decompresses a data blob.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--d99ad754-c9fa-4244-b4fa-69a0b2191e24","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0147","name":"Pteranodon","url":"https://attack.mitre.org/software/S0147","kind":"malware","description":"[Pteranodon](https://attack.mitre.org/software/S0147) can decrypt encrypted data strings prior to using them.(Citation: Microsoft Actinium February 2022)","relationship_id":"relationship--7ce7aa48-afa9-4eb6-8bc2-8f04fd6cf00e","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020) The [Cobalt Strike](https://attack.mitre.org/software/S0154) loader component can also decrypt the .bss section of the Beacon binary prior to execution.(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--b1065110-5387-4dee-b27e-f671d75f403f","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S0160","name":"certutil","url":"https://attack.mitre.org/software/S0160","kind":"tool","description":"[certutil](https://attack.mitre.org/software/S0160) has been used to decode binaries hidden inside certificate files as Base64 information.(Citation: Malwarebytes Targeted Attack against Saudi Arabia)","relationship_id":"relationship--5918cee6-c2f1-41be-ab96-36f3d17e5293","references":[{"source_name":"Malwarebytes Targeted Attack against Saudi Arabia","description":"Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.","url":"https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) deobfuscates its strings and APIs once its executed.(Citation: US-CERT Volgmer 2 Nov 2017)","relationship_id":"relationship--fd2f1a44-2ae7-4df0-b53c-42bc96af2da1","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","description":"US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) extracts and decrypts stage 3 malware, which is stored in encrypted resources.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--d4bffc31-3d7a-4f05-a85d-fdaaaa70853d","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0188","name":"Starloader","url":"https://attack.mitre.org/software/S0188","kind":"malware","description":"[Starloader](https://attack.mitre.org/software/S0188) decrypts and executes shellcode from a file called Stars.jps.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--283bdd5f-f356-43a2-864c-6f8211073d45","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"S0189","name":"ISMInjector","url":"https://attack.mitre.org/software/S0189","kind":"malware","description":"[ISMInjector](https://attack.mitre.org/software/S0189) uses the <code>certutil</code> command to decode a payload file.(Citation: OilRig New Delivery Oct 2017)","relationship_id":"relationship--566d783a-2d86-4b9a-8ca0-5013de5f7fb4","references":[{"source_name":"OilRig New Delivery Oct 2017","description":"Falcone, R. and Lee, B. (2017, October 9). OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan. Retrieved January 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"}]},{"id":"S0196","name":"PUNCHBUGGY","url":"https://attack.mitre.org/software/S0196","kind":"malware","description":"[PUNCHBUGGY](https://attack.mitre.org/software/S0196) has used [PowerShell](https://attack.mitre.org/techniques/T1059/001) to decode base64-encoded assembly.(Citation: Morphisec ShellTea June 2019)","relationship_id":"relationship--bdd9a384-2d57-4238-bddd-5500e667d620","references":[{"source_name":"Morphisec ShellTea June 2019","description":"Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.","url":"http://blog.morphisec.com/security-alert-fin8-is-back"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) can deobfuscate the main backdoor code.(Citation: ClearSky MuddyWater Nov 2018)","relationship_id":"relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f","references":[{"source_name":"ClearSky MuddyWater Nov 2018","description":"ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"}]},{"id":"S0226","name":"Smoke Loader","url":"https://attack.mitre.org/software/S0226","kind":"malware","description":"[Smoke Loader](https://attack.mitre.org/software/S0226) deobfuscates its code.(Citation: Talos Smoke Loader July 2018)","relationship_id":"relationship--0c4af99b-e82d-422f-86da-ccc94e55d763","references":[{"source_name":"Talos Smoke Loader July 2018","description":"Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}]},{"id":"S0230","name":"ZeroT","url":"https://attack.mitre.org/software/S0230","kind":"malware","description":"[ZeroT](https://attack.mitre.org/software/S0230) shellcode decrypts and decompresses its RC4-encrypted payload.(Citation: Proofpoint ZeroT Feb 2017)","relationship_id":"relationship--026a63ae-dd3d-4ea6-8a32-c40c9b37b893","references":[{"source_name":"Proofpoint ZeroT Feb 2017","description":"Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) has decoded its PowerShell script.(Citation: CheckPoint Bandook Nov 2020)","relationship_id":"relationship--ebd78850-caf0-4e14-8338-0f7347063afc","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) decrypts and extracts a copy of its main DLL payload when executing.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--2d822996-4574-402d-8d0f-1cfc0e963850","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) decodes embedded XOR strings.(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--5412525e-cba5-4fa1-89ff-7e6fa2b92e24","references":[{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can decrypt strings using the victim's hostname as the key.(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--959092cf-5647-4c25-b64e-3e84061511a5","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) decodes its secondary payload and writes it to the victim’s machine. [Zebrocy](https://attack.mitre.org/software/S0251) also uses AES and XOR to decrypt strings and payloads.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)","relationship_id":"relationship--e3be5269-92fd-488e-be35-ddc91030f7c3","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"}]},{"id":"S0255","name":"DDKONG","url":"https://attack.mitre.org/software/S0255","kind":"malware","description":"[DDKONG](https://attack.mitre.org/software/S0255) decodes an embedded configuration using XOR.(Citation: Rancor Unit42 June 2018)","relationship_id":"relationship--309652a1-45a4-4479-9e84-dfab33d0a1f5","references":[{"source_name":"Rancor Unit42 June 2018","description":"Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) decrypts code, strings, and commands to use once it's on the victim's machine.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--54c703f9-67ef-4622-afed-0ebbd2563e9e","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0258","name":"RGDoor","url":"https://attack.mitre.org/software/S0258","kind":"malware","description":"[RGDoor](https://attack.mitre.org/software/S0258) decodes Base64 strings and decrypts strings using a custom XOR algorithm.(Citation: Unit 42 RGDoor Jan 2018)","relationship_id":"relationship--d4240d9a-1499-4863-a654-a52a1dbf48b4","references":[{"source_name":"Unit 42 RGDoor Jan 2018","description":"Falcone, R. (2018, January 25). OilRig uses RGDoor IIS Backdoor on Targets in the Middle East. Retrieved July 6, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--b6a89ded-fa53-42b9-8f40-03c845123ac0","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0263","name":"TYPEFRAME","url":"https://attack.mitre.org/software/S0263","kind":"malware","description":"One [TYPEFRAME](https://attack.mitre.org/software/S0263) variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value \"0x35\".(Citation: US-CERT TYPEFRAME June 2018)","relationship_id":"relationship--77b9e1c5-8241-4260-8125-4bc2e1206b9c","references":[{"source_name":"US-CERT TYPEFRAME June 2018","description":"US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}]},{"id":"S0264","name":"OopsIE","url":"https://attack.mitre.org/software/S0264","kind":"malware","description":"[OopsIE](https://attack.mitre.org/software/S0264) concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.(Citation: Unit 42 OopsIE! Feb 2018)","relationship_id":"relationship--3cd2c187-587c-4969-957d-122ce654fc2a","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","description":"Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) decodes the configuration data and modules.(Citation: Fidelis TrickBot Oct 2016)(Citation: Cyberreason Anchor December 2019)(Citation: Joe Sec Trickbot)","relationship_id":"relationship--af7c56df-ced8-45b7-9aef-be1039e30cea","references":[{"source_name":"Fidelis TrickBot Oct 2016","description":"Reaves, J. (2016, October 15). TrickBot: We Missed you, Dyre. Retrieved August 2, 2018.","url":"https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"},{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Joe Sec Trickbot","description":"Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.","url":"https://www.joesecurity.org/blog/498839998833561473"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has decoded strings in the malware using XOR and RC4.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020) ","relationship_id":"relationship--49f9b769-57d1-4d73-8194-59b584a72c1b","references":[{"source_name":"Unit 42 Bisonal July 2018","description":"Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"},{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0269","name":"QUADAGENT","url":"https://attack.mitre.org/software/S0269","kind":"malware","description":"[QUADAGENT](https://attack.mitre.org/software/S0269) uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.(Citation: Unit 42 QUADAGENT July 2018)","relationship_id":"relationship--198cddce-40f7-43eb-aeac-60171f111065","references":[{"source_name":"Unit 42 QUADAGENT July 2018","description":"Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}]},{"id":"S0270","name":"RogueRobin","url":"https://attack.mitre.org/software/S0270","kind":"malware","description":"[RogueRobin](https://attack.mitre.org/software/S0270) decodes an embedded executable using base64 and decompresses it.(Citation: Unit42 DarkHydrus Jan 2019)","relationship_id":"relationship--f304b74c-85c7-4bd6-85bc-bec918a4fb7e","references":[{"source_name":"Unit42 DarkHydrus Jan 2019","description":"Lee, B., Falcone, R. (2019, January 18). DarkHydrus delivers new Trojan that can use Google Drive for C2 communications. Retrieved April 17, 2019.","url":"https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"}]},{"id":"S0279","name":"Proton","url":"https://attack.mitre.org/software/S0279","kind":"malware","description":"[Proton](https://attack.mitre.org/software/S0279) uses an encrypted file to store commands and configuration values.(Citation: objsee mac malware 2017)","relationship_id":"relationship--8183d862-5383-4a42-acbd-be58e120cb25","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0280","name":"MirageFox","url":"https://attack.mitre.org/software/S0280","kind":"malware","description":"[MirageFox](https://attack.mitre.org/software/S0280) has a function for decrypting data containing C2 configuration information.(Citation: APT15 Intezer June 2018)","relationship_id":"relationship--f16f0b46-3363-48bd-9a13-c8751fdedf1c","references":[{"source_name":"APT15 Intezer June 2018","description":"Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.","url":"https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"}]},{"id":"S0284","name":"More_eggs","url":"https://attack.mitre.org/software/S0284","kind":"malware","description":"[More_eggs](https://attack.mitre.org/software/S0284) will decode malware components that are then dropped to the system.(Citation: Security Intelligence More Eggs Aug 2019)","relationship_id":"relationship--095f6266-2535-4991-ad6b-64388513d6e7","references":[{"source_name":"Security Intelligence More Eggs Aug 2019","description":"Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) decrypts strings in the code during the execution process.(Citation: Talos Zeus Panda Nov 2017)","relationship_id":"relationship--e6aed3c5-9f4a-4178-b03b-5805b2f61c81","references":[{"source_name":"Talos Zeus Panda Nov 2017","description":"Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.(Citation: Malwarebytes Agent Tesla April 2020)","relationship_id":"relationship--a4105315-b63d-47c9-9526-3dd388d892b4","references":[{"source_name":"Malwarebytes Agent Tesla April 2020","description":"Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) decrypts task and configuration files for execution.(Citation: ESET Carbon Mar 2017)(Citation: Accenture HyperStack October 2020)","relationship_id":"relationship--848313af-f9c3-4b51-a24a-d2e88487ab53","references":[{"source_name":"Accenture HyperStack October 2020","description":"Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"},{"source_name":"ESET Carbon Mar 2017","description":"ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) uses an XOR key to decrypt content and uses Base64 to decode the C2 address.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)","relationship_id":"relationship--3733dda5-9dd9-43d1-ac3a-24f1b5fb86e7","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","description":"Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}]},{"id":"S0347","name":"AuditCred","url":"https://attack.mitre.org/software/S0347","kind":"malware","description":"[AuditCred](https://attack.mitre.org/software/S0347) uses XOR and RC4 to perform decryption on the code functions.(Citation: TrendMicro Lazarus Nov 2018)","relationship_id":"relationship--d98b5525-3cc5-4058-baf5-d614b91eb814","references":[{"source_name":"TrendMicro Lazarus Nov 2018","description":"Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) decodes many of its artifacts and is decrypted (AES-128) after being downloaded.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--bfe474ce-d88f-4372-9918-a04470ba080e","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0352","name":"OSX_OCEANLOTUS.D","url":"https://attack.mitre.org/software/S0352","kind":"malware","description":"[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.(Citation: Unit42 OceanLotus 2017)","relationship_id":"relationship--4ca73e82-4e56-4044-a21a-d613a80f171c","references":[{"source_name":"Unit42 OceanLotus 2017","description":"Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.","url":"https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) uses a unique, custom de-obfuscation technique.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--be07fb4e-06db-4bb0-a1e0-23f34b24a97f","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) will decrypt important strings used for C&C communication.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--33d24077-13af-4e14-ba79-87ca145c5383","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0355","name":"Final1stspy","url":"https://attack.mitre.org/software/S0355","kind":"malware","description":"[Final1stspy](https://attack.mitre.org/software/S0355) uses Python code to deobfuscate base64-encoded strings.(Citation: Unit 42 Nokki Oct 2018)","relationship_id":"relationship--347ee2ed-7def-45ac-9935-063a679859ae","references":[{"source_name":"Unit 42 Nokki Oct 2018","description":"Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)","relationship_id":"relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46","references":[{"source_name":"Medium KONNI Jan 2020","description":"Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0361","name":"Expand","url":"https://attack.mitre.org/software/S0361","kind":"tool","description":"[Expand](https://attack.mitre.org/software/S0361) can be used to decompress a local or remote CAB file into an executable.(Citation: Microsoft Expand Utility)","relationship_id":"relationship--31fa2481-0b4f-40d4-b438-1d04a7eb0888","references":[{"source_name":"Microsoft Expand Utility","description":"Microsoft. (2017, October 15). Expand. Retrieved February 19, 2019.","url":"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.(Citation: Binary Defense Emotes Wi-Fi Spreader)","relationship_id":"relationship--7e4db234-1923-4bfb-ab32-284f31182c76","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","description":"Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"}]},{"id":"S0369","name":"CoinTicker","url":"https://attack.mitre.org/software/S0369","kind":"malware","description":"[CoinTicker](https://attack.mitre.org/software/S0369) decodes the initially-downloaded hidden encoded file using OpenSSL.(Citation: CoinTicker 2019)","relationship_id":"relationship--a6944696-304c-4813-8285-56275e926f9f","references":[{"source_name":"CoinTicker 2019","description":"Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.","url":"https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/"}]},{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. (Citation: Cybereason Astaroth Feb 2019)(Citation: Securelist Brazilian Banking Malware July 2020)","relationship_id":"relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b","references":[{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"},{"source_name":"Securelist Brazilian Banking Malware July 2020","description":"GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}]},{"id":"S0375","name":"Remexi","url":"https://attack.mitre.org/software/S0375","kind":"malware","description":"[Remexi](https://attack.mitre.org/software/S0375) decrypts the configuration data using XOR with 25-character keys.(Citation: Securelist Remexi Jan 2019)","relationship_id":"relationship--85b0be36-c9fb-4359-b9b6-4e13300e374b","references":[{"source_name":"Securelist Remexi Jan 2019","description":"Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.(Citation: ESET Ebury Oct 2017)","relationship_id":"relationship--4800e509-0653-4895-a9f0-e0b538592875","references":[{"source_name":"ESET Ebury Oct 2017","description":"Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.(Citation: ProofPoint Ursnif Aug 2016)","relationship_id":"relationship--6ee02f06-6250-4c75-b20f-c3271442f59e","references":[{"source_name":"ProofPoint Ursnif Aug 2016","description":"Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"}]},{"id":"S0388","name":"YAHOYAH","url":"https://attack.mitre.org/software/S0388","kind":"malware","description":"[YAHOYAH](https://attack.mitre.org/software/S0388) decrypts downloaded files before execution.(Citation: TrendMicro TropicTrooper 2015)","relationship_id":"relationship--74e1dbd9-baad-488f-9b30-4430420e15d3","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"id":"S0390","name":"SQLRat","url":"https://attack.mitre.org/software/S0390","kind":"malware","description":"[SQLRat](https://attack.mitre.org/software/S0390) has scripts that are responsible for deobfuscating additional scripts.(Citation: Flashpoint FIN 7 March 2019)","relationship_id":"relationship--b7f13afc-0e1c-4142-b05c-def10c17a8d6","references":[{"source_name":"Flashpoint FIN 7 March 2019","description":"Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"id":"S0394","name":"HiddenWasp","url":"https://attack.mitre.org/software/S0394","kind":"malware","description":"[HiddenWasp](https://attack.mitre.org/software/S0394) uses a cipher to implement a decoding function.(Citation: Intezer HiddenWasp Map 2019)","relationship_id":"relationship--b6df63b7-34af-4918-8d1d-cf3dad0287f8","references":[{"source_name":"Intezer HiddenWasp Map 2019","description":"Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.","url":"https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"}]},{"id":"S0395","name":"LightNeuron","url":"https://attack.mitre.org/software/S0395","kind":"malware","description":"[LightNeuron](https://attack.mitre.org/software/S0395) has used AES and XOR to decrypt configuration files and commands.(Citation: ESET LightNeuron May 2019)","relationship_id":"relationship--54d9e07f-eff6-41e9-8821-3bb7ac657c8c","references":[{"source_name":"ESET LightNeuron May 2019","description":"Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}]},{"id":"S0398","name":"HyperBro","url":"https://attack.mitre.org/software/S0398","kind":"malware","description":"[HyperBro](https://attack.mitre.org/software/S0398) can unpack and decrypt its payload prior to execution.(Citation: Trend Micro DRBControl February 2020)(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--6cb89bfe-73f6-47d8-beb5-f8b2d66e0bfd","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0401","name":"Exaramel for Linux","url":"https://attack.mitre.org/software/S0401","kind":"malware","description":"[Exaramel for Linux](https://attack.mitre.org/software/S0401) can decrypt its configuration file.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--6f64c3b9-7882-4bcf-9ff2-3dcce03cf632","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0402","name":"OSX/Shlayer","url":"https://attack.mitre.org/software/S0402","kind":"malware","description":"[OSX/Shlayer](https://attack.mitre.org/software/S0402) can base64-decode and AES-decrypt downloaded payloads.(Citation: Carbon Black Shlayer Feb 2019) Versions of [OSX/Shlayer](https://attack.mitre.org/software/S0402) pass encrypted and password-protected code to <code>openssl</code> and then write the payload to the <code>/tmp</code> folder.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--8a2fbf8a-a05c-44d7-a270-afe092de9db5","references":[{"source_name":"Carbon Black Shlayer Feb 2019","description":"Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.","url":"https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"},{"source_name":"sentinelone shlayer to zshlayer","description":"Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.","url":"https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409)’s downloaded data is decrypted using AES.(Citation: ESET Machete July 2019)","relationship_id":"relationship--075c6890-45e1-495e-a83e-b81ab05a8b4e","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has the ability to decode downloaded files prior to execution.(Citation: CISA AA20-301A Kimsuky)","relationship_id":"relationship--843aedaa-bbf0-4f29-bcfd-bd226ca7ef31","references":[{"source_name":"CISA AA20-301A Kimsuky","description":"CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"id":"S0415","name":"BOOSTWRITE","url":"https://attack.mitre.org/software/S0415","kind":"malware","description":"[BOOSTWRITE](https://attack.mitre.org/software/S0415) has used a a 32-byte long multi-XOR key to decode data inside its payload.(Citation: FireEye FIN7 Oct 2019)\t","relationship_id":"relationship--07bbfaa8-c62f-4abc-845c-55b28434d058","references":[{"source_name":"FireEye FIN7 Oct 2019","description":"Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has used LZMA and base64 libraries to decode obfuscated scripts.(Citation: Talos PoetRAT October 2020)","relationship_id":"relationship--df0ee75f-5e10-40d7-a0ac-e6c281e0d4b9","references":[{"source_name":"Talos PoetRAT October 2020","description":"Mercer, W. Rascagneres, P. Ventura, V. (2020, October 6). PoetRAT: Malware targeting public and private sector in Azerbaijan evolves . Retrieved April 9, 2021.","url":"https://blog.talosintelligence.com/2020/10/poetrat-update.html"}]},{"id":"S0430","name":"Winnti for Linux","url":"https://attack.mitre.org/software/S0430","kind":"malware","description":"[Winnti for Linux](https://attack.mitre.org/software/S0430) has decoded XOR encoded strings holding its configuration upon execution.(Citation: Chronicle Winnti for Linux May 2019)","relationship_id":"relationship--45e9de66-7203-48e9-bd9b-096c289f35db","references":[{"source_name":"Chronicle Winnti for Linux May 2019","description":"Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has decoded malware components that are then dropped to the system.(Citation: QiAnXin APT-C-36 Feb2019)","relationship_id":"relationship--239cb026-369a-43f0-922c-cdc38d124430","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) has the ability to decrypt, load, and execute a DLL and its resources.(Citation: JPCert TSCookie March 2018)","relationship_id":"relationship--2b062058-3345-4993-9715-6ad6e98dc2ad","references":[{"source_name":"JPCert TSCookie March 2018","description":"Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"[Okrum](https://attack.mitre.org/software/S0439)'s loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--b3f66735-fafe-49be-b55c-4d087d1351a7","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0443","name":"MESSAGETAP","url":"https://attack.mitre.org/software/S0443","kind":"malware","description":"After checking for the existence of two files, keyword_parm.txt and parm.txt, [MESSAGETAP](https://attack.mitre.org/software/S0443) XOR decodes and read the contents of the files. (Citation: FireEye MESSAGETAP October 2019)","relationship_id":"relationship--97323d60-9623-4b3e-8ff9-50370fef4e5b","references":[{"source_name":"FireEye MESSAGETAP October 2019","description":"Leong, R., Perez, D., Dean, T. (2019, October 31). MESSAGETAP: Who’s Reading Your Text Messages?. Retrieved May 11, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--980a5f66-14d7-42c6-82f7-ef96cbab77bb","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.(Citation: Talos Lokibot Jan 2021)","relationship_id":"relationship--13bc2a82-c51d-4410-9e62-223df287b8f7","references":[{"source_name":"Talos Lokibot Jan 2021","description":"Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) has decrypted itself using a single-byte XOR scheme. Additionally, [Rising Sun](https://attack.mitre.org/software/S0448) can decrypt its configuration data at runtime.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--4f89d6c4-29ec-4777-bbc9-b0ea78064c42","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"Upon execution, [Metamorfo](https://attack.mitre.org/software/S0455) has unzipped itself after being downloaded to the system and has performed string decryption.(Citation: Medium Metamorfo Apr 2020)(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019) ","relationship_id":"relationship--f264330f-3c9f-4a2a-a6f6-904a9139bbf5","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to decrypt the loader configuration and payload DLL.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--26303f07-87f0-4740-b6ea-e81e8c01b267","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457)'s PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the [Netwalker](https://attack.mitre.org/software/S0457) DLL being loaded into memory.(Citation: Sophos Netwalker May 2020)","relationship_id":"relationship--3967e156-2135-4416-b3c3-79372d19d610","references":[{"source_name":"Sophos Netwalker May 2020","description":"Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.","url":"https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can extract its agent from the body of a malicious document.(Citation: Eset Ramsay May 2020)\t","relationship_id":"relationship--ed6d663f-510b-4702-9c2a-ef40cc4d88c7","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to decrypt and decompress its payload to enable code execution.(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)","relationship_id":"relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab","references":[{"source_name":"IBM TA505 April 2020","description":"Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020.","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0466","name":"WindTail","url":"https://attack.mitre.org/software/S0466","kind":"malware","description":"[WindTail](https://attack.mitre.org/software/S0466) has the ability to decrypt strings using hard-coded AES keys.(Citation: objective-see windtail1 dec 2018)","relationship_id":"relationship--b4016d43-d8c4-4ca2-b119-0681ebe8aaff","references":[{"source_name":"objective-see windtail1 dec 2018","description":"Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3B.html"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) has the ability to download, unpack, and decrypt tar.gz files .(Citation: Trend Micro Skidmap) ","relationship_id":"relationship--952412b3-a7b1-402c-a92e-96830df4d14b","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0469","name":"ABK","url":"https://attack.mitre.org/software/S0469","kind":"malware","description":"[ABK](https://attack.mitre.org/software/S0469) has the ability to decrypt AES encrypted payloads.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--3c8467e6-0878-4c62-afe6-55f124872089","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0470","name":"BBK","url":"https://attack.mitre.org/software/S0470","kind":"malware","description":"[BBK](https://attack.mitre.org/software/S0470) has the ability to decrypt AES encrypted payloads.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--7562ef46-c452-4338-9e06-3afdcf2c0e04","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to decrypt files downloaded from C2.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--70b94aa6-7cf1-4cf5-b00b-aed156036f1e","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0475","name":"BackConfig","url":"https://attack.mitre.org/software/S0475","kind":"malware","description":"[BackConfig](https://attack.mitre.org/software/S0475) has used a custom routine to decrypt strings.(Citation: Unit 42 BackConfig May 2020)","relationship_id":"relationship--e823be4b-50b9-4430-9010-e960b46bdfcc","references":[{"source_name":"Unit 42 BackConfig May 2020","description":"Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) has the ability to decode and decrypt downloaded files.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)","relationship_id":"relationship--b99e218f-942b-4643-b4de-35649d2a4cbd","references":[{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"},{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"id":"S0477","name":"Goopy","url":"https://attack.mitre.org/software/S0477","kind":"malware","description":"[Goopy](https://attack.mitre.org/software/S0477) has used a polymorphic decryptor to decrypt itself at runtime.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--c9aa1bb6-874a-4de6-84c8-e1e9d1d112d0","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) has used <code>openssl</code> to decrypt AES encrypted payload data. [Bundlore](https://attack.mitre.org/software/S0482) has also used base64 and RC4 with a hardcoded key to deobfuscate data.(Citation: MacKeeper Bundlore Apr 2019)","relationship_id":"relationship--68cfc5f9-3c65-4f24-8018-cf811d7b6c9f","references":[{"source_name":"MacKeeper Bundlore Apr 2019","description":"Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) has decrypted the binary's configuration once the <code>main</code> function was launched.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--54e76e33-91b4-409f-a784-7e181f82b216","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0492","name":"CookieMiner","url":"https://attack.mitre.org/software/S0492","kind":"malware","description":"[CookieMiner](https://attack.mitre.org/software/S0492) has used Google Chrome's decryption and extraction operations.(Citation: Unit42 CookieMiner Jan 2019)","relationship_id":"relationship--8bed4012-0b27-409b-8236-1b5238dd477d","references":[{"source_name":"Unit42 CookieMiner Jan 2019","description":"Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}]},{"id":"S0495","name":"RDAT","url":"https://attack.mitre.org/software/S0495","kind":"malware","description":"[RDAT](https://attack.mitre.org/software/S0495) can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.(Citation: Unit42 RDAT July 2020)\t","relationship_id":"relationship--63b6fd1d-65a7-4c94-8045-16fd198802f1","references":[{"source_name":"Unit42 RDAT July 2020","description":"Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can decode encrypted strings to enable execution of commands and payloads.(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--a0ff37b8-1a73-45dd-a645-fe2a43fad9f6","references":[{"source_name":"G Data Sodinokibi June 2019","description":"Han, Karsten. (2019, June 4). Strange Bits: Sodinokibi Spam, CinaRAT, and Fake G DATA. Retrieved August 4, 2020.","url":"https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"},{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S0499","name":"Hancitor","url":"https://attack.mitre.org/software/S0499","kind":"malware","description":"[Hancitor](https://attack.mitre.org/software/S0499) has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. [Hancitor](https://attack.mitre.org/software/S0499) has also extracted executables from ZIP files.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)","relationship_id":"relationship--ffecf9e6-6966-4535-934f-4fd4696875b0","references":[{"source_name":"Threatpost Hancitor","description":"Tom Spring. (2017, January 11). Spammers Revive Hancitor Downloader Campaigns. Retrieved August 13, 2020.","url":"https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"},{"source_name":"FireEye Hancitor","description":"Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.","url":"https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) can decrypt password-protected executables.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--d2bc4516-c074-4d44-9931-07ab518de60a","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0502","name":"Drovorub","url":"https://attack.mitre.org/software/S0502","kind":"malware","description":"[Drovorub](https://attack.mitre.org/software/S0502) has de-obsfuscated XOR encrypted payloads in WebSocket messages.(Citation: NSA/FBI Drovorub August 2020)","relationship_id":"relationship--994846d3-7130-4374-bd6e-278ad870fa94","references":[{"source_name":"NSA/FBI Drovorub August 2020","description":"NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}]},{"id":"S0511","name":"RegDuke","url":"https://attack.mitre.org/software/S0511","kind":"malware","description":"[RegDuke](https://attack.mitre.org/software/S0511) can decrypt strings with a key either stored in the Registry or hardcoded in the code.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--8ea64034-60a6-466d-9434-19d05180626c","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can decrypt AES encrypted C2 communications.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--fbe5352c-7c4f-437c-a439-d212ba6d439b","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0513","name":"LiteDuke","url":"https://attack.mitre.org/software/S0513","kind":"malware","description":"[LiteDuke](https://attack.mitre.org/software/S0513) has the ability to decrypt and decode multiple layers of obfuscation.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--0575a941-3af6-4b7b-93df-30f6001760ac","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0514","name":"WellMess","url":"https://attack.mitre.org/software/S0514","kind":"malware","description":"[WellMess](https://attack.mitre.org/software/S0514) can decode and decrypt data received from C2.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)(Citation: CISA WellMess July 2020)","relationship_id":"relationship--c958d98c-d3d9-40cf-9702-5d9cb2cdf719","references":[{"source_name":"PWC WellMess July 2020","description":"PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source_name":"PWC WellMess C2 August 2020","description":"PWC. (2020, August 17). WellMess malware: analysis of its Command and Control (C2) server. Retrieved September 29, 2020.","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"},{"source_name":"CISA WellMess July 2020","description":"CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"}]},{"id":"S0515","name":"WellMail","url":"https://attack.mitre.org/software/S0515","kind":"malware","description":"[WellMail](https://attack.mitre.org/software/S0515) can decompress scripts received from C2.(Citation: CISA WellMail July 2020)","relationship_id":"relationship--a511a41e-0ab0-4088-8617-5de975b5d9a8","references":[{"source_name":"CISA WellMail July 2020","description":"CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) can decode and decrypt exfiltrated data sent to C2.(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--ec218695-e481-4895-97a2-5383949cb04d","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) has been decompressed by included shellcode prior to being launched.(Citation: Trustwave Pillowmint June 2020)\t","relationship_id":"relationship--abece522-51dc-4904-b0f9-585db7fb0223","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0518","name":"PolyglotDuke","url":"https://attack.mitre.org/software/S0518","kind":"malware","description":"[PolyglotDuke](https://attack.mitre.org/software/S0518) can use a custom algorithm to decrypt strings used by the malware.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--fe2eb5b7-7ae1-4df1-a49e-ad13f50510e8","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0520","name":"BLINDINGCAN","url":"https://attack.mitre.org/software/S0520","kind":"malware","description":"[BLINDINGCAN](https://attack.mitre.org/software/S0520) has used AES and XOR to decrypt its DLLs.(Citation: US-CERT BLINDINGCAN Aug 2020)","relationship_id":"relationship--ea027248-40a2-403b-a0e9-748bdc8c5667","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","description":"US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}]},{"id":"S0526","name":"KGH_SPY","url":"https://attack.mitre.org/software/S0526","kind":"malware","description":"[KGH_SPY](https://attack.mitre.org/software/S0526) can decrypt encrypted strings and write them to a newly created folder.(Citation: Cybereason Kimsuky November 2020)","relationship_id":"relationship--f2cb5393-d33f-4ee3-a2c0-197c1e032ea5","references":[{"source_name":"Cybereason Kimsuky November 2020","description":"Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can decrypt its encrypted internal strings.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--ade847d9-4ce6-4b63-accb-7070c926e5b5","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can decrypt its C2 address upon execution.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can decrypt downloaded payloads. [Bazar](https://attack.mitre.org/software/S0534) also resolves strings and other artifacts at runtime.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--d9e7b8b3-6275-4c26-b9d2-4adfa1143c1b","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0543","name":"Spark","url":"https://attack.mitre.org/software/S0543","kind":"malware","description":"[Spark](https://attack.mitre.org/software/S0543) has used a custom XOR algorithm to decrypt the payload.(Citation: Unit42 Molerat Mar 2020) ","relationship_id":"relationship--b1a30826-465a-4342-8ceb-e0bd4ef50063","references":[{"source_name":"Unit42 Molerat Mar 2020","description":"Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020.","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"id":"S0546","name":"SharpStage","url":"https://attack.mitre.org/software/S0546","kind":"malware","description":"[SharpStage](https://attack.mitre.org/software/S0546) has decompressed data received from the C2 server.(Citation: BleepingComputer Molerats Dec 2020)","relationship_id":"relationship--a6bf495a-9769-433b-8754-e57f5e9045b7","references":[{"source_name":"BleepingComputer Molerats Dec 2020","description":"Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}]},{"id":"S0547","name":"DropBook","url":"https://attack.mitre.org/software/S0547","kind":"malware","description":"[DropBook](https://attack.mitre.org/software/S0547) can unarchive data downloaded from the C2 to obtain the payload and persistence modules.(Citation: Cybereason Molerats Dec 2020) ","relationship_id":"relationship--8e2b7383-c6dc-40c1-bb88-3176ff98c9dc","references":[{"source_name":"Cybereason Molerats Dec 2020","description":"Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has been decrypted before execution.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cybereason Egregor Nov 2020) ","relationship_id":"relationship--66044dfc-ab9a-4de4-a20b-cfed6d3f6236","references":[{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"},{"source_name":"Cybereason Egregor Nov 2020","description":"Rochberger, L. (2020, November 26). Cybereason vs. Egregor Ransomware. Retrieved December 30, 2020.","url":"https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware"}]},{"id":"S0560","name":"TEARDROP","url":"https://attack.mitre.org/software/S0560","kind":"malware","description":"[TEARDROP](https://attack.mitre.org/software/S0560) was decoded using a custom rolling XOR algorithm to execute a customized [Cobalt Strike](https://attack.mitre.org/software/S0154) payload.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Check Point Sunburst Teardrop December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--bccf4511-1e01-42ed-ab75-65d558e3fa3f","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Check Point Sunburst Teardrop December 2020","description":"Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021.","url":"https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) decrypts [SUNBURST](https://attack.mitre.org/software/S0559), which was stored in AES128-CBC encrypted blobs.(Citation: CrowdStrike SUNSPOT Implant January 2021)  ","relationship_id":"relationship--b8333924-1556-4c3f-b60f-105984e1f715","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0565","name":"Raindrop","url":"https://attack.mitre.org/software/S0565","kind":"malware","description":"[Raindrop](https://attack.mitre.org/software/S0565) decrypted its [Cobalt Strike](https://attack.mitre.org/software/S0154) payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--ff10b414-cc17-4335-9030-1262e5401b39","references":[{"source_name":"Symantec RAINDROP January 2021","description":"Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567) has used a decryption routine that is part of an executable physical patch.(Citation: Securelist Dtrack)","relationship_id":"relationship--ff8241d6-2a4c-41ea-b86d-43082ca0fb48","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"}]},{"id":"S0574","name":"BendyBear","url":"https://attack.mitre.org/software/S0574","kind":"malware","description":"[BendyBear](https://attack.mitre.org/software/S0574) has decrypted function blocks using a XOR key during runtime to evade detection.(Citation: Unit42 BendyBear Feb 2021)","relationship_id":"relationship--045da2d4-f599-447b-931b-c11e8692fa1c","references":[{"source_name":"Unit42 BendyBear Feb 2021","description":"Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) has decrypted its payload using a hardcoded AES-256 key.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)","relationship_id":"relationship--2ca546e0-6a3f-4a9f-82c3-2e41ffa67b79","references":[{"source_name":"Cybereason Conti Jan 2021","description":"Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"},{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) has used a Base64 key to decode its components.(Citation: IBM MegaCortex)","relationship_id":"relationship--9a36085f-d0a9-41f2-a9cf-97e81c286ef2","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) has the ability to decrypt its RC4 encrypted payload for execution.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--6e73108a-836f-47ad-b88a-6b9a70ebcb7b","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0581","name":"IronNetInjector","url":"https://attack.mitre.org/software/S0581","kind":"tool","description":"[IronNetInjector](https://attack.mitre.org/software/S0581) has the ability to decrypt embedded .NET and PE payloads.(Citation: Unit 42 IronNetInjector February 2021 )","relationship_id":"relationship--b16b1e0e-63b0-4c5b-8809-476d9645948c","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","description":"Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) has a function that decrypts malicious data.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--fdb22ee1-d90b-496b-a7f7-baf155a1930c","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0584","name":"AppleJeus","url":"https://attack.mitre.org/software/S0584","kind":"malware","description":"[AppleJeus](https://attack.mitre.org/software/S0584) has decoded files received from a C2.(Citation: CISA AppleJeus Feb 2021)","relationship_id":"relationship--026d4fb6-4683-4e64-a69c-82e39dd11b23","references":[{"source_name":"CISA AppleJeus Feb 2021","description":"Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}]},{"id":"S0585","name":"Kerrdown","url":"https://attack.mitre.org/software/S0585","kind":"malware","description":"[Kerrdown](https://attack.mitre.org/software/S0585) can decode, decrypt, and decompress multiple layers of shellcode.(Citation: Unit 42 KerrDown February 2019)","relationship_id":"relationship--cd82d148-f6b1-4247-8ccf-49fadbe7f245","references":[{"source_name":"Unit 42 KerrDown February 2019","description":"Ray, V. and Hayashi, K. (2019, February 1). Tracking OceanLotus’ new Downloader, KerrDown. Retrieved October 1, 2021.","url":"https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"}]},{"id":"S0588","name":"GoldMax","url":"https://attack.mitre.org/software/S0588","kind":"malware","description":"[GoldMax](https://attack.mitre.org/software/S0588) has decoded and decrypted the configuration file when executed.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)","relationship_id":"relationship--99e6e6cb-c19e-4689-8c92-b5429c709b91","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"},{"source_name":"FireEye SUNSHUTTLE Mar 2021","description":"Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"}]},{"id":"S0589","name":"Sibot","url":"https://attack.mitre.org/software/S0589","kind":"malware","description":"[Sibot](https://attack.mitre.org/software/S0589) can decrypt data received from a C2 and save to a file.(Citation: MSTIC NOBELIUM Mar 2021)","relationship_id":"relationship--aafa7447-cb73-4309-ac75-5326ab0d1079","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has decrypted a binary blob to start execution.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--26a6be0e-6d53-4f54-b190-af359bfab4fc","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0598","name":"P.A.S. Webshell","url":"https://attack.mitre.org/software/S0598","kind":"malware","description":"[P.A.S. Webshell](https://attack.mitre.org/software/S0598) can use a decryption mechanism to process a user supplied password and allow execution.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has decrypted ELF files with AES.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--ac5693ea-3d10-47bd-b91b-a65177dd5462","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) decrypts resources that are loaded into memory and executed.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--3921c748-c29e-4c2f-b5cb-bcc7c0237219","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) decrypts code to connect to a remote C2 server.(Citation: ESET Industroyer)","relationship_id":"relationship--f3d0ffd9-5bda-46fd-ba44-ef1b1def9506","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) can decode and decrypt messages received from C2.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--9dcec42b-174d-4b74-8aab-c5727a71c25c","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) has used a simple XOR operation to decrypt strings.(Citation: Mcafee Clop Aug 2019)","relationship_id":"relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612)'s custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.(Citation: NCC Group WastedLocker June 2020)","relationship_id":"relationship--c9ebddf7-337f-4002-84fd-84a7744b78e1","references":[{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}]},{"id":"S0613","name":"PS1","url":"https://attack.mitre.org/software/S0613","kind":"malware","description":"[PS1](https://attack.mitre.org/software/S0613) can use an XOR key to decrypt a PowerShell loader and payload binary.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--bf9adcbf-3d35-4d70-b681-e7180f3c08da","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0614","name":"CostaBricks","url":"https://attack.mitre.org/software/S0614","kind":"malware","description":"[CostaBricks](https://attack.mitre.org/software/S0614) has the ability to use bytecode to decrypt embedded payloads.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--f2d433c3-d134-4985-8dc1-b35d407b330a","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can run <code>upload</code> to decrypt and upload files from storage.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--21281614-d7cc-4211-9365-d318c99cb906","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0618","name":"FIVEHANDS","url":"https://attack.mitre.org/software/S0618","kind":"malware","description":"[FIVEHANDS](https://attack.mitre.org/software/S0618) has the ability to decrypt its payload prior to execution.(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)","relationship_id":"relationship--afd2f545-557a-4113-bc0a-3191e71bcbea","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"NCC Group Fivehands June 2021","description":"Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can decode its payload prior to execution.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--3a6a72e8-0637-41db-b455-6b5d629aba28","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) has decrypted the password of the C2 server with a simple byte by byte XOR. [Siloscape](https://attack.mitre.org/software/S0623) also writes both an archive of [Tor](https://attack.mitre.org/software/S0183) and the <code>unzip</code> binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--95fc8b91-eda2-49e9-b2fb-b3cdfacc0eaa","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0624","name":"Ecipekac","url":"https://attack.mitre.org/software/S0624","kind":"malware","description":"[Ecipekac](https://attack.mitre.org/software/S0624) has the ability to decrypt fileless loader modules.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--f8e31b9d-941d-4f58-ae3a-3bdbf4b2a923","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0628","name":"FYAnti","url":"https://attack.mitre.org/software/S0628","kind":"malware","description":"[FYAnti](https://attack.mitre.org/software/S0628) has the ability to decrypt an embedded .NET module.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--c9759e33-1cdd-472a-b3fc-f3263f218fdb","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can decrypt its payload via a XOR key.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--2e2e3a71-51b6-4779-a376-a9cc2750b5da","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) has decrypted an AES encrypted binary file to trigger the download of other files.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--ebbb5d6e-9949-436b-85c5-5cd90a681042","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--c9256d21-a464-477a-8756-96eae300b0e4","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0634","name":"EnvyScout","url":"https://attack.mitre.org/software/S0634","kind":"malware","description":"[EnvyScout](https://attack.mitre.org/software/S0634) can deobfuscate and write malicious ISO files to disk.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--68896b85-a0ed-4b99-a776-dbdd3092ac07","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can decrypt AES-encrypted files downloaded from C2.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--353dd407-0850-4bc4-a447-cd1b708b3833","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0636","name":"VaporRage","url":"https://attack.mitre.org/software/S0636","kind":"malware","description":"[VaporRage](https://attack.mitre.org/software/S0636) can deobfuscate XOR-encoded shellcode prior to execution.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--1a06ec1e-319c-4229-8ec7-b368f3886791","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0637","name":"NativeZone","url":"https://attack.mitre.org/software/S0637","kind":"malware","description":"[NativeZone](https://attack.mitre.org/software/S0637) can decrypt and decode embedded  [Cobalt Strike](https://attack.mitre.org/software/S0154) beacon stage shellcode.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--abeb8fca-e470-4119-a07f-a6ec2f4b4667","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) has the ability to unpack itself into memory using XOR.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: Medium Babuk February 2021)","relationship_id":"relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"Medium Babuk February 2021","description":"Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021.","url":"https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has decrypted encrypted strings.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0641","name":"Kobalos","url":"https://attack.mitre.org/software/S0641","kind":"malware","description":"[Kobalos](https://attack.mitre.org/software/S0641) decrypts strings right after the initial communication, but before the authentication process.(Citation: ESET Kobalos Jan 2021) ","relationship_id":"relationship--8265aa36-4e63-4ee9-8cfe-4ed82839efce","references":[{"source_name":"ESET Kobalos Jan 2021","description":"M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"}]},{"id":"S0642","name":"BADFLICK","url":"https://attack.mitre.org/software/S0642","kind":"malware","description":"[BADFLICK](https://attack.mitre.org/software/S0642) can decode shellcode using a custom rotating XOR cipher.(Citation: Accenture MUDCARP March 2019)","relationship_id":"relationship--d1a489c9-f937-4cc8-85d0-b4ce6b961a62","references":[{"source_name":"Accenture MUDCARP March 2019","description":"Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--9d293200-1425-4a77-8a2e-75a1ffb78310","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can deobfuscate and re-assemble code strings for execution.(Citation: Cyberint Qakbot May 2021)(Citation: ATT QakBot April 2021)(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2","references":[{"source_name":"Cyberint Qakbot May 2021","description":"Cyberint. (2021, May 25). Qakbot Banking Trojan. Retrieved September 27, 2021.","url":"https://blog.cyberint.com/qakbot-banking-trojan"},{"source_name":"ATT QakBot April 2021","description":"Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0653","name":"xCaon","url":"https://attack.mitre.org/software/S0653","kind":"malware","description":"[xCaon](https://attack.mitre.org/software/S0653) has decoded strings from the C2 server before executing commands.(Citation: Checkpoint IndigoZebra July 2021) ","relationship_id":"relationship--f2034fc3-e721-42ce-be50-d58668c5da4b","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can deobfuscate its payload prior to execution.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--ae788f2a-e2d8-4615-8714-f1263c987b23","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661) can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--23679538-e90c-430d-b375-6d8bbf8ec723","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can deobfuscate packed binaries in memory.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--1387ec64-ba36-42cd-b659-c29e708d8281","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0665","name":"ThreatNeedle","url":"https://attack.mitre.org/software/S0665","kind":"malware","description":"[ThreatNeedle](https://attack.mitre.org/software/S0665) can decrypt its payload using RC4, AES, or one-byte XORing.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--b71e10b8-e566-470b-8a5c-b634ddfd3965","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can decompress and decrypt DLLs and shellcode.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) can decrypt its encrypted internal code.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--53b64a61-b521-4767-9c3a-bb73d518aa15","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) has deobfuscated itself before executing its commands.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--03b52236-a63f-4ffe-88bd-15cb5ac69a66","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can use XOR 0x45 to decrypt obfuscated code.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--7e941100-b4aa-43fa-a7c5-328fb211ecce","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) has the ability to self-extract as a RAR archive.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--a6bb9c7f-3e1c-429a-a81d-0d446f4abe9a","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) can decrypt downloaded modules prior to execution.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--45f7f495-2de8-4f78-87ec-14201cfc1d46","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0678","name":"Torisma","url":"https://attack.mitre.org/software/S0678","kind":"malware","description":"[Torisma](https://attack.mitre.org/software/S0678) has used XOR and Base64 to decode C2 data.(Citation: McAfee Lazarus Nov 2020)","relationship_id":"relationship--512b3fed-39aa-407d-b274-5a65229688b7","references":[{"source_name":"McAfee Lazarus Nov 2020","description":"Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) has decrypted its configuration data, such as the C2 IP address, ports and other network communication.(Citation: BiZone Lizar May 2021)(Citation: SekoiaBourhis_DiceLoader_Feb2024)","relationship_id":"relationship--9b8ff6e6-8b67-4182-9752-fa1cf15c0485","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","description":"Bourhis, P., Sekoia TDR. (2024, February 1). Unveiling the intricacies of DiceLoader. Retrieved May 14, 2025.","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) can decrypt and parse instructions sent from C2.(Citation: NCSC Cyclops Blink February 2022)","relationship_id":"relationship--e98ae201-7492-4aef-9b17-6499956bbe2b","references":[{"source_name":"NCSC Cyclops Blink February 2022","description":"NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)","relationship_id":"relationship--c89f4447-e8dc-4b6f-aa52-fade3ced3268","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"Medium S2W WhisperGate January 2022","description":"S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}]},{"id":"S0690","name":"Green Lambert","url":"https://attack.mitre.org/software/S0690","kind":"malware","description":"[Green Lambert](https://attack.mitre.org/software/S0690) can use multiple custom routines to decrypt strings prior to execution.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)","relationship_id":"relationship--817dc3ce-3e77-4e91-a9e4-9c8c8579e722","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","description":"Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","description":"Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can decompress and copy driver files using `LZCopy`.(Citation: Crowdstrike DriveSlayer February 2022)","relationship_id":"relationship--8580c1e0-84fd-4da9-a9e8-1ae17f1b67d2","references":[{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}]},{"id":"S1012","name":"PowerLess","url":"https://attack.mitre.org/software/S1012","kind":"malware","description":"[PowerLess](https://attack.mitre.org/software/S1012) can use base64 and AES ECB decryption prior to execution of downloaded modules.(Citation: Cybereason PowerLess February 2022)","relationship_id":"relationship--dfcd4d41-11f4-4891-9e49-7a725ab18d1d","references":[{"source_name":"Cybereason PowerLess February 2022","description":"Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) has used a XOR key to decrypt strings.(Citation: Cisco Talos Bitter Bangladesh May 2022)","relationship_id":"relationship--f649505a-555f-4939-980e-916a511c3134","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1014","name":"DanBot","url":"https://attack.mitre.org/software/S1014","kind":"malware","description":"[DanBot](https://attack.mitre.org/software/S1014) can use a VBA macro to decode its payload prior to installation and execution.(Citation: SecureWorks August 2019)","relationship_id":"relationship--d0146a8e-8658-40c4-8232-bec51e1ab9a2","references":[{"source_name":"SecureWorks August 2019","description":"SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) decrypts a downloaded file using AES-128-EBC with a custom delta.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--a412040d-d8ed-48b4-979c-7cbc6f9ced1c","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) can deobfuscate strings and files for execution.(Citation: Malwarebytes Saint Bot April 2021)","relationship_id":"relationship--b105573a-4d07-4253-8a5b-82f68357e098","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}]},{"id":"S1019","name":"Shark","url":"https://attack.mitre.org/software/S1019","kind":"malware","description":"[Shark](https://attack.mitre.org/software/S1019) can extract and decrypt downloaded .zip files.(Citation: ClearSky Siamesekitten August 2021)","relationship_id":"relationship--b10f18a6-43a8-436f-8d9c-f180428f0a0d","references":[{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1022","name":"IceApple","url":"https://attack.mitre.org/software/S1022","kind":"malware","description":"[IceApple](https://attack.mitre.org/software/S1022) can use a Base64-encoded AES key to decrypt tasking.(Citation: CrowdStrike IceApple May 2022)","relationship_id":"relationship--753b0a84-4455-4706-babf-f9bf75e530be","references":[{"source_name":"CrowdStrike IceApple May 2022","description":"CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has decoded antivirus name strings.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--d850589b-a36f-446e-9864-ae4d4a62b724","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S1026","name":"Mongall","url":"https://attack.mitre.org/software/S1026","kind":"malware","description":"[Mongall](https://attack.mitre.org/software/S1026) has the ability to decrypt its payload prior to execution.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--2310e7b8-a4c7-460d-a89d-8d5854c59a44","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can decrypt its payload prior to execution.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--52893247-a6d6-4119-881a-09e10121edf5","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1028","name":"Action RAT","url":"https://attack.mitre.org/software/S1028","kind":"malware","description":"[Action RAT](https://attack.mitre.org/software/S1028) can use Base64 to decode actor-controlled C2 server communications.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--0303acd0-64a4-4e40-b8e3-29e1c43694d2","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1030","name":"Squirrelwaffle","url":"https://attack.mitre.org/software/S1030","kind":"malware","description":"[Squirrelwaffle](https://attack.mitre.org/software/S1030) has decrypted files and payloads using a XOR-based algorithm.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)","relationship_id":"relationship--39e0a84e-24de-4b0f-a0e4-3a821b8f963a","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","description":"Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"},{"source_name":"Netskope Squirrelwaffle Oct 2021","description":"Palazolo, G. (2021, October 7). SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot. Retrieved August 9, 2022.","url":"https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"}]},{"id":"S1031","name":"PingPull","url":"https://attack.mitre.org/software/S1031","kind":"malware","description":"[PingPull](https://attack.mitre.org/software/S1031) can decrypt received data from its C2 server by using AES.(Citation: Unit 42 PingPull Jun 2022)","relationship_id":"relationship--d0a02e9b-9247-4bce-9070-649d7c908640","references":[{"source_name":"Unit 42 PingPull Jun 2022","description":"Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}]},{"id":"S1032","name":"PyDCrypt","url":"https://attack.mitre.org/software/S1032","kind":"malware","description":"[PyDCrypt](https://attack.mitre.org/software/S1032) has decrypted and dropped the [DCSrv](https://attack.mitre.org/software/S1033) payload to disk.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--4e3a250d-c168-4544-82c5-3b1414be826d","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can deobfuscate C2 server responses and unpack its code on targeted hosts.(Citation: Proofpoint Bumblebee April 2022)(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--3471a32a-47fc-4ba7-ac67-887d9872e316","references":[{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1041","name":"Chinoxy","url":"https://attack.mitre.org/software/S1041","kind":"malware","description":"The [Chinoxy](https://attack.mitre.org/software/S1041) dropping function can initiate decryption of its config file.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--356aa4b0-e6c2-4ef7-a3b2-837c25c283b3","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1046","name":"PowGoop","url":"https://attack.mitre.org/software/S1046","kind":"malware","description":"[PowGoop](https://attack.mitre.org/software/S1046) can decrypt PowerShell scripts for execution.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)","relationship_id":"relationship--c935af5a-b6e3-41b8-afa8-f9d7ad593201","references":[{"source_name":"CYBERCOM Iranian Intel Cyber January 2022","description":"Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022.","url":"https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1047","name":"Mori","url":"https://attack.mitre.org/software/S1047","kind":"malware","description":"[Mori](https://attack.mitre.org/software/S1047) can resolve networking APIs from strings that are ADD-encrypted.(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--7d37a0f1-1aea-456c-ade6-6d463a14fc14","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--8a36b1bf-52a8-4e93-bac2-e28c60b7d64d","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1051","name":"KEYPLUG","url":"https://attack.mitre.org/software/S1051","kind":"malware","description":"[KEYPLUG](https://attack.mitre.org/software/S1051) can decode its configuration file to determine C2 protocols.(Citation: Mandiant APT41)","relationship_id":"relationship--43c68bb8-28e2-4ee0-91aa-ffc16dcc45bc","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1052","name":"DEADEYE","url":"https://attack.mitre.org/software/S1052","kind":"malware","description":"[DEADEYE](https://attack.mitre.org/software/S1052) has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.(Citation: Mandiant APT41)","relationship_id":"relationship--a4cc226c-2858-4040-a90d-5cf1297fd78c","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has deobfuscated XOR-encoded strings.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--748cd538-d2a0-470c-b6fb-68e73b8069b1","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can decrypt and load other modules.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--5998186f-20af-4b30-8ae7-4d4648d96327","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can decrypt files and data.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--4975b6f9-c542-4ad9-bfeb-6182c4db895f","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) has the ability to deobfuscate its payload prior to execution.(Citation: Palo Alto Brute Ratel July 2022)","relationship_id":"relationship--7ee1407c-ee33-47bc-824a-6f0dcd385462","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can deobfuscate Base64-encoded strings and scripts.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can decrypt its payload and associated configuration elements using the Rijndael cipher.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--0977c267-10f9-4e4d-a947-464359c7a4ba","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1076","name":"QUIETCANARY","url":"https://attack.mitre.org/software/S1076","kind":"malware","description":"[QUIETCANARY](https://attack.mitre.org/software/S1076) can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--27d0ccf1-00df-40f5-ad96-807e54862467","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"[RotaJakiro](https://attack.mitre.org/software/S1078) uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the `head` and `key` sections in the network packet structure used for C2 communications.(Citation: RotaJakiro 2021 netlab360 analysis)","relationship_id":"relationship--0924ca96-c26b-4bd1-8c50-d3c1a9e1e25b","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","description":" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.(Citation: Symantec FIN8 Jul 2023)","relationship_id":"relationship--582215ef-b7dd-43c3-a4ca-3a4a14edde59","references":[{"source_name":"Symantec FIN8 Jul 2023","description":"Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"id":"S1086","name":"Snip3","url":"https://attack.mitre.org/software/S1086","kind":"malware","description":"[Snip3](https://attack.mitre.org/software/S1086) can decode its second-stage PowerShell script prior to execution.(Citation: Morphisec Snip3 May 2021)","relationship_id":"relationship--03e6a535-5c95-47e7-a369-aed653022c7c","references":[{"source_name":"Morphisec Snip3 May 2021","description":"Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.","url":"https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"}]},{"id":"S1097","name":"HUI Loader","url":"https://attack.mitre.org/software/S1097","kind":"malware","description":"[HUI Loader](https://attack.mitre.org/software/S1097) can decrypt and load files containing malicious payloads.(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)","relationship_id":"relationship--950d2e53-296a-491e-aadf-8cc5d04df41b","references":[{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","description":"Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"The [Ninja](https://attack.mitre.org/software/S1100) loader component can decrypt and decompress the payload.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--78160020-3c63-4e60-81f4-f6438bfbd6a4","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) decodes configuration items from a bundled file for command and control activity.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--ccb19fb9-7c27-4941-b383-62386a4a6429","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1110","name":"SLIGHTPULSE","url":"https://attack.mitre.org/software/S1110","kind":"malware","description":"[SLIGHTPULSE](https://attack.mitre.org/software/S1110) can deobfuscate base64 encoded and RC4 encrypted C2 messages.(Citation: Mandiant Pulse Secure Zero-Day April 2021)","relationship_id":"relationship--627ec847-1807-4e99-b968-f1ab412d17d1","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) installation includes binary code stored in a file located in a hidden directory, such as <code>shell.txt</code>, that is decrypted then executed.(Citation: Ensilo Darkgate 2018) [DarkGate](https://attack.mitre.org/software/S1111) uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API <code>CallWindowProc()</code> to decode and then execute.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--a7f61ae3-bbeb-40c8-86c9-bed3cf1e1953","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1112","name":"STEADYPULSE","url":"https://attack.mitre.org/software/S1112","kind":"malware","description":"[STEADYPULSE](https://attack.mitre.org/software/S1112) can URL decode key/value pairs sent over C2.(Citation: Mandiant Pulse Secure Zero-Day April 2021)","relationship_id":"relationship--d86a36a9-fce9-4147-b375-292d6b617769","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"id":"S1113","name":"RAPIDPULSE","url":"https://attack.mitre.org/software/S1113","kind":"malware","description":"[RAPIDPULSE](https://attack.mitre.org/software/S1113) listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter <code>hmacTime</code>. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--254dea59-0bd6-4966-9eff-d5997a7e91c1","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"S1115","name":"WIREFIRE","url":"https://attack.mitre.org/software/S1115","kind":"malware","description":"[WIREFIRE](https://attack.mitre.org/software/S1115) can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.(Citation: Mandiant Cutting Edge January 2024)","relationship_id":"relationship--2329e6c4-5462-4d14-9a50-2d9272f83a09","references":[{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1117","name":"GLASSTOKEN","url":"https://attack.mitre.org/software/S1117","kind":"malware","description":"[GLASSTOKEN](https://attack.mitre.org/software/S1117) has the ability to decode hexadecimal and Base64 C2 requests.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)","relationship_id":"relationship--55fc98ea-8269-4ac7-9209-9013de03c955","references":[{"source_name":"Volexity Ivanti Zero-Day Exploitation January 2024","description":"Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024.","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"}]},{"id":"S1118","name":"BUSHWALK","url":"https://attack.mitre.org/software/S1118","kind":"malware","description":"[BUSHWALK](https://attack.mitre.org/software/S1118) can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--f2938ba0-1768-48a8-a36d-9d1578c6f5b1","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"},{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1119","name":"LIGHTWIRE","url":"https://attack.mitre.org/software/S1119","kind":"malware","description":"[LIGHTWIRE](https://attack.mitre.org/software/S1119) can RC4 decrypt and Base64 decode C2 commands.(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--44caec3d-e8d3-48b6-9991-f5b164370538","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1120","name":"FRAMESTING","url":"https://attack.mitre.org/software/S1120","kind":"malware","description":"[FRAMESTING](https://attack.mitre.org/software/S1120) can decompress data received within `POST` requests.(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--eacb139c-69ea-44a5-b299-6a2db03e4079","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) decrypts its encrypted configuration files prior to execution.(Citation: SCILabs Malteiro 2021)(Citation: ESET Security Mispadu Facebook Ads 2019)","relationship_id":"relationship--0da38f11-0e39-4505-aa05-61464113ba8f","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"S1123","name":"PITSTOP","url":"https://attack.mitre.org/software/S1123","kind":"malware","description":"[PITSTOP](https://attack.mitre.org/software/S1123) can deobfuscate base64 encoded and AES encrypted commands.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--e7caa3b3-78d3-4840-bee3-70d7637f5508","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) contains several layers of obfuscation to hide malicious code from detection and analysis.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--c9a2ee9a-4787-47c0-9cdc-f52735f066ad","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133) compiled code is obfuscated in an unspecified fashion prior to delivery to victims.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--f7a7e19a-7d6b-43ca-91a4-4aab1dbfeecc","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1134","name":"DEADWOOD","url":"https://attack.mitre.org/software/S1134","kind":"malware","description":"[DEADWOOD](https://attack.mitre.org/software/S1134) XORs some strings within the binary using the value <code>0xD5</code>, and deobfuscates these items at runtime.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--a91a486b-4119-44e1-9fcf-c746849947e8","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1138","name":"Gootloader","url":"https://attack.mitre.org/software/S1138","kind":"malware","description":"[Gootloader](https://attack.mitre.org/software/S1138) has the ability to decode and decrypt malicious payloads prior to execution.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)","relationship_id":"relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a","references":[{"source_name":"SentinelOne Gootloader June 2021","description":"Pirozzi, A. (2021, June 16). Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets. Retrieved May 28, 2024.","url":"https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"},{"source_name":"Sophos Gootloader","description":"Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.","url":"https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--821c06ba-1cdc-40a7-bd4a-97e996bb973e","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1140","name":"Spica","url":"https://attack.mitre.org/software/S1140","kind":"malware","description":"Upon execution [Spica](https://attack.mitre.org/software/S1140) can decode an embedded .pdf and write it to the desktop as a decoy document.(Citation: Google TAG COLDRIVER January 2024)","relationship_id":"relationship--e7c81430-1c3a-4ee8-9f10-4a3fcad2da54","references":[{"source_name":"Google TAG COLDRIVER January 2024","description":"Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can decrypt strings related to communication configuration using RC4 with a static key.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--613c0bcd-d165-472b-adc8-1e547edb13af","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can decrypt strings to retrieve configuration settings.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--38d896b7-6e7a-44e0-9b52-77da42dd59f6","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1143","name":"LunarLoader","url":"https://attack.mitre.org/software/S1143","kind":"malware","description":"[LunarLoader](https://attack.mitre.org/software/S1143) can deobfuscate files containing the next stages in the infection chain.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--7ae8b9cf-2524-4861-8246-394a96339f49","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1145","name":"Pikabot","url":"https://attack.mitre.org/software/S1145","kind":"malware","description":"[Pikabot](https://attack.mitre.org/software/S1145) decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm.(Citation: Zscaler Pikabot 2023) Other versions of [Pikabot](https://attack.mitre.org/software/S1145) decode chunks of stored stage 2 payload content in the initial payload <code>.text</code> section before consolidating them for further execution.(Citation: Elastic Pikabot 2024) Overall [LunarMail](https://attack.mitre.org/software/S1142) is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.(Citation: Logpoint Pikabot 2024)","relationship_id":"relationship--bf46855b-a15e-4789-a8e6-d5ad3261ded3","references":[{"source_name":"Zscaler Pikabot 2023","description":"Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"},{"source_name":"Elastic Pikabot 2024","description":"Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"},{"source_name":"Logpoint Pikabot 2024","description":"Swachchhanda Shrawan Poudel. (2024, February). Pikabot: 
 A Sophisticated and Modular Backdoor Trojan with Advanced Evasion Techniques. Retrieved July 12, 2024.","url":"https://www.logpoint.com/wp-content/uploads/2024/02/logpoint-etpr-pikabot.pdf"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) stores network configuration data in a file XOR encoded with the key value of `0x7A`.(Citation: Symantec Daggerfly 2024)","relationship_id":"relationship--fbf9654c-45f2-41bc-83ec-3dfdfa6d5115","references":[{"source_name":"Symantec Daggerfly 2024","description":"Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)","relationship_id":"relationship--de6e7fde-7407-4caf-acd0-cfa3aa458d04","references":[{"source_name":"Sekoia Raccoon1 2022","description":"Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can use an embedded RC4 key to decrypt Windows API function strings.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--5e53c0fb-e7f9-4b6d-a0a0-b7c64b5a3b6e","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can decrypt embedded scripts prior to execution.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)","relationship_id":"relationship--708ac02f-8419-43bd-a6d6-682e28faa507","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","description":"CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) strings are deobfuscated prior to execution.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)","relationship_id":"relationship--64eeba9b-c972-4671-bb08-fca6d2445b8a","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"},{"source_name":"SentinelOne Cuckoo Stealer May 2024","description":"Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.","url":"https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"}]},{"id":"S1158","name":"DUSTPAN","url":"https://attack.mitre.org/software/S1158","kind":"malware","description":"[DUSTPAN](https://attack.mitre.org/software/S1158) decodes and decrypts embedded payloads.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--92bab2d2-bb5a-4102-a9ec-7630153cac50","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) deobfuscates embedded payloads.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--68501e6a-dba6-4a77-a711-99ca6918a2dd","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"[Latrodectus](https://attack.mitre.org/software/S1160) has the ability to deobfuscate encrypted strings.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--5a56f203-5537-4dd1-a08d-db4526bf75bd","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1164","name":"UPSTYLE","url":"https://attack.mitre.org/software/S1164","kind":"malware","description":"[UPSTYLE](https://attack.mitre.org/software/S1164) encodes its main content prior to loading via Python as base64-encoded blobs.(Citation: Volexity UPSTYLE 2024)(Citation: Palo Alto MidnightEclipse APR 2024)","relationship_id":"relationship--1bd6e148-29c0-473e-8752-66bd01e3a629","references":[{"source_name":"Palo Alto MidnightEclipse APR 2024","description":"Unit 42. (2024, April 12). Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 . Retrieved January 15, 2025.","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/"},{"source_name":"Volexity UPSTYLE 2024","description":"Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}]},{"id":"S1168","name":"SampleCheck5000","url":"https://attack.mitre.org/software/S1168","kind":"malware","description":"[SampleCheck5000](https://attack.mitre.org/software/S1168) can decode and decrypt command line strings and files received through C2.(Citation: ESET OilRig Campaigns Sep 2023)(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--60061356-7b82-4bd0-b9bc-ae1518753f3a","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"},{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1170","name":"ODAgent","url":"https://attack.mitre.org/software/S1170","kind":"malware","description":"[ODAgent](https://attack.mitre.org/software/S1170) can Base64-decode and XOR decrypt received C2 commands.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--f5435422-0bf4-4ca2-af11-12fe12d13f8e","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) can Base64-decode and XOR-decrypt C2 commands taken from JSON files.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--f59927fc-7a14-44bf-9164-47ac08cf86a4","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1173","name":"PowerExchange","url":"https://attack.mitre.org/software/S1173","kind":"malware","description":"[PowerExchange](https://attack.mitre.org/software/S1173) can decode and decrypt C2 commands received via email.(Citation: Symantec Crambus OCT 2023)","relationship_id":"relationship--c66a8b99-9928-4b4c-83e8-e416de4d07b3","references":[{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"id":"S1179","name":"Exbyte","url":"https://attack.mitre.org/software/S1179","kind":"malware","description":"[Exbyte](https://attack.mitre.org/software/S1179) decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--59b93237-62e9-42bf-a3a4-8dc2148464f2","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) is distributed as an obfuscated JavaScript launcher file.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--d3937396-a1e5-46c7-87a8-f9653895714f","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1182","name":"MagicRAT","url":"https://attack.mitre.org/software/S1182","kind":"malware","description":"[MagicRAT](https://attack.mitre.org/software/S1182) stores command and control URLs using base64 encoding in the malware's configuration file.(Citation: Cisco MagicRAT 2022)","relationship_id":"relationship--bf984c42-b059-4e2e-af65-d316569bd426","references":[{"source_name":"Cisco MagicRAT 2022","description":"Asheer Malhotra, Vitor Ventura & Jungsoo An, Cisco Talos. (2022, September 7). MagicRAT: Lazarus’ latest gateway into victim networks. Retrieved December 30, 2024.","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) payloads have included strings encrypted via XOR.(Citation: DCSO StrelaStealer 2022) [StrelaStealer](https://attack.mitre.org/software/S1183) JavaScript payloads utilize Base64-encoded payloads that are decoded via [certutil](https://attack.mitre.org/software/S0160) to create a malicious DLL file.(Citation: PaloAlto StrelaStealer 2024)(Citation: Fortgale StrelaStealer 2023)","relationship_id":"relationship--c948844f-25f3-4fbd-b949-f6c61a459aeb","references":[{"source_name":"PaloAlto StrelaStealer 2024","description":"Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.","url":"https://unit42.paloaltonetworks.com/strelastealer-campaign/"},{"source_name":"DCSO StrelaStealer 2022","description":"DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"},{"source_name":"Fortgale StrelaStealer 2023","description":"Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"}]},{"id":"S1186","name":"Line Dancer","url":"https://attack.mitre.org/software/S1186","kind":"malware","description":"[Line Dancer](https://attack.mitre.org/software/S1186) shellcode payloads are base64 encoded when transmitted to compromised devices.(Citation: CCCS ArcaneDoor 2024)","relationship_id":"relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1","references":[{"source_name":"CCCS ArcaneDoor 2024","description":"Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.","url":"https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) utilizes obfuscated JSON structures for various data storage and configuration management items.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--aff5ce36-4e3e-475e-b039-3424d5296521","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can decode scripts and strings in loaded modules.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--74efbb05-7272-4cf4-9fa7-5720e8bfe26d","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can deobfuscate loaded modules prior to execution.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--f3dcd0dd-8657-47b4-b523-38e68bc0ee0f","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"The [LockBit 3.0](https://attack.mitre.org/software/S1202) payload is decrypted at runtime.(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)","relationship_id":"relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) uses XOR and RC4 algorithms to decrypt payloads and functions.(Citation: Zscaler XLoader 2025) [XLoader](https://attack.mitre.org/software/S1207) can be distributed as a self-extracting RAR archive that launches an AutoIT loader.(Citation: Google XLoader 2017)","relationship_id":"relationship--b4f15c4f-eedd-4045-bdec-57393716fa50","references":[{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"},{"source_name":"Zscaler XLoader 2025","description":"Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) uses a custom decryption routine to unpack itself during installation.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--7aab5534-4c3b-4812-a612-eccee79396f6","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can use a provided passphrase to decrypt its configuration file.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--677e51a3-11ba-4685-8374-f5a21677f37d","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has used Base64-encoded content during execution, decoded via PowerShell.(Citation: Netskope LummaStealer 2025)","relationship_id":"relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413","references":[{"source_name":"Netskope LummaStealer 2025","description":"Leandro Fróes, Netskope. (2025, January 23). Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection. Retrieved March 22, 2025.","url":"https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"}]},{"id":"S1219","name":"REPTILE","url":"https://attack.mitre.org/software/S1219","kind":"malware","description":"The [REPTILE](https://attack.mitre.org/software/S1219) launcher component can decrypt kernel module code from a file and load it into memory.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--8cd609cc-a203-424e-bcea-264dd83f4d5a","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1221","name":"MOPSLED","url":"https://attack.mitre.org/software/S1221","kind":"malware","description":"[MOPSLED](https://attack.mitre.org/software/S1221) can decrypt obfuscated configuration files.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--6b66277b-be7b-484b-86f4-fd97c7a4d4b7","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1222","name":"RIFLESPINE","url":"https://attack.mitre.org/software/S1222","kind":"malware","description":"[RIFLESPINE](https://attack.mitre.org/software/S1222) can deobfuscate encrypted files prior to execution on targeted hosts.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--69563781-6287-402d-926d-c671005ee240","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1223","name":"THINCRUST","url":"https://attack.mitre.org/software/S1223","kind":"malware","description":"[THINCRUST](https://attack.mitre.org/software/S1223) can deobfuscate RSA encrypted C2 commands received through the DEVICEID cookie.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--a2644706-c75e-47b9-8167-f9db9481262e","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"S1224","name":"CASTLETAP","url":"https://attack.mitre.org/software/S1224","kind":"malware","description":"[CASTLETAP](https://attack.mitre.org/software/S1224) can filter and deobfuscate an XOR encrypted activation string in the payload of an ICMP echo request.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--340825b1-a2db-4be1-943a-9b529842ae18","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has decoded its Base64 encoded payload prior to execution.(Citation: Palo Alto Networks, Unit 42)  [BOOKWORM](https://attack.mitre.org/software/S1226) has also encrypted files with RC4 and has decrypted its payload prior to execution.(Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--7bfbdba0-2f18-4697-bf86-294bda685df5","references":[{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}]},{"id":"S1227","name":"StarProxy","url":"https://attack.mitre.org/software/S1227","kind":"malware","description":"[StarProxy](https://attack.mitre.org/software/S1227) has decrypted network packets using a custom algorithm.(Citation: Zscaler)","relationship_id":"relationship--fc61d659-2c80-4148-92ff-b689093a49b2","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has decoded its payload prior to execution.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Lab52 MUSTANG PANDA PUBLOAD MAY 2023)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Palo Alto Networks, Unit 42)","relationship_id":"relationship--5bb98e61-548f-4ba0-9a25-50cbca531826","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","description":"Dex. (n.d.). New Mustang Panda’s campaing against Australia. Retrieved August 4, 2025.","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}]},{"id":"S1232","name":"SplatDropper","url":"https://attack.mitre.org/software/S1232","kind":"malware","description":"[SplatDropper](https://attack.mitre.org/software/S1232) has decoded XOR encrypted payload.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--ab5fd28f-c304-46a2-a07d-c037dc67ba2c","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1235","name":"CorKLOG","url":"https://attack.mitre.org/software/S1235","kind":"malware","description":"[CorKLOG](https://attack.mitre.org/software/S1235) has decoded XOR encrypted strings.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--5149c8de-5790-4f52-8527-1e2aac11b381","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1236","name":"CLAIMLOADER","url":"https://attack.mitre.org/software/S1236","kind":"malware","description":"[CLAIMLOADER](https://attack.mitre.org/software/S1236) has decoded its payload prior to execution.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)","relationship_id":"relationship--e9a7ebd2-e8ec-4047-84d2-831018de10ab","references":[{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","description":"Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has decoded its payload prior to execution.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Zscaler)(Citation: Unit42 Chinese VSCode 06 September 2024)","relationship_id":"relationship--8a3a6312-e5fc-44bd-858c-886d0aa8b7c7","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"},{"source_name":"Unit42 Chinese VSCode 06 September 2024","description":"Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has decoded its payload prior to execution.(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--a1e3d08f-cec9-48df-b377-6f0d0d223e3b","references":[{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has decoded XOR encrypted strings prior to execution in memory.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--799e9c4b-2f06-4917-8f91-aa1c7773f56b","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has decoded XOR-encrypted and Base-64-encoded payloads prior to execution.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--3e0509c4-02e0-4f07-9b8c-7c51687494cf","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has utilized MDeployer to decrypt two payloads that contain MS4Killer toolkit b.cache and the [Embargo](https://attack.mitre.org/software/S1247) ransomware executable a.cache with a hardcoded RC4 key `wlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB`.(Citation: ESET Embargo Ransomware October 2024)","relationship_id":"relationship--7d4609c1-6f92-44e4-8580-158bb2c91426","references":[{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]},{"id":"S1248","name":"XORIndex Loader","url":"https://attack.mitre.org/software/S1248","kind":"malware","description":"[XORIndex Loader](https://attack.mitre.org/software/S1248) can decode its payload prior to execution.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)","relationship_id":"relationship--21b4dd86-a629-4e42-944c-f5e4b90e5312","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}]},{"id":"S1249","name":"HexEval Loader","url":"https://attack.mitre.org/software/S1249","kind":"malware","description":"[HexEval Loader](https://attack.mitre.org/software/S1249) has decoded its payload prior to execution.(Citation: Socket Contagious Interview NPM April 2025)(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--c0b37fb2-6a19-40cf-bb18-a7289e235398","references":[{"source_name":"Socket Contagious Interview NPM April 2025","description":"Kirill Boychenko. (2025, April 4). Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads. Retrieved October 20, 2025.","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has the ability to decrypt RC4 encrypted packets and to decode obfuscated data before C2 communication.(Citation: AhnLab_SystemBC_Apr2022) Additionally, [SystemBC](https://attack.mitre.org/software/S9001) has decrypted its config file that was encoded with XOR and a hardcoded 40-byte key.(Citation: Lumen_SystemBC_Sept2025)","relationship_id":"relationship--441fa206-c1cf-40dd-850e-897adcf4776f","references":[{"source_name":"AhnLab_SystemBC_Apr2022","description":"AhnLab. (2022, April 4). SystemBC Being Used by Various Attackers . Retrieved June 18, 2025.","url":"https://asec.ahnlab.com/en/33600/"},{"source_name":"Lumen_SystemBC_Sept2025","description":"Black Lotus Labs . (2025, September 18). SystemBC: Bringing the noise. Retrieved December 15, 2025.","url":"https://blog.lumen.com/systembc-bringing-the-noise/"}]},{"id":"S9007","name":"HTTPTroy","url":"https://attack.mitre.org/software/S9007","kind":"malware","description":"[HTTPTroy](https://attack.mitre.org/software/S9007) has decoded strings encoded with Base64 and XOR prior to execution.(Citation: Gen Digital Kimsuky HTTPTroy October 2025)","relationship_id":"relationship--acedb80d-7646-4c2f-a4e2-3623410823e9","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has decoded its Base64 instructions.(Citation: Koi Glassworm InvisibleCode October 2025)  [GlassWorm](https://attack.mitre.org/software/S9010) has also decrypted its AES protected payloads.(Citation: Koi Glassworm New Tricks December 2025)(Citation: Koi Glassworm InvisibleCode October 2025)(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--397cb08d-0466-4f92-8317-73da637dcded","references":[{"source_name":"Koi Glassworm New Tricks December 2025","description":"Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"},{"source_name":"Koi Glassworm InvisibleCode October 2025","description":"Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"},{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9011","name":"BRUSHFIRE","url":"https://attack.mitre.org/software/S9011","kind":"malware","description":"[BRUSHFIRE](https://attack.mitre.org/software/S9011) has decrypted XOR strings prior to execution.(Citation: Google UNC5221 Ivanti April 2025)","relationship_id":"relationship--3cadf7f7-481c-45e4-b64b-ed03b349be20","references":[{"source_name":"Google UNC5221 Ivanti April 2025","description":"John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"}]},{"id":"S9014","name":"PHASEJAM","url":"https://attack.mitre.org/software/S9014","kind":"malware","description":"[PHASEJAM](https://attack.mitre.org/software/S9014) has the ability to decode Base64 commands and data.(Citation: Google UNC5221 Ivanti January 2025)","relationship_id":"relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has decoded its encrypted C2 traffic prior to execution.(Citation: CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025)(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)(Citation: Picus Security BRICKSTORM UNC5221 October 2025)(Citation: Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025)(Citation: Google BRICKSTORM September 2025) [BRICKSTORM](https://attack.mitre.org/software/S9015) also has the ability to decode its obfuscated payload before execution.(Citation: Picus Security BRICKSTORM UNC5221 October 2025)","relationship_id":"relationship--7b292c68-de29-4db0-8f07-67028da4a595","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","description":"CrowdStrike. (2025, December 4). Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary. Retrieved April 16, 2026.","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","description":"Huseyin Can Yuceel. (2025, October 1). BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States. Retrieved April 16, 2026.","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025","description":"Resecurity Threat Intelligence & Incident Analysis. (2025, October 22). F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"},{"source_name":"Google BRICKSTORM September 2025","description":"Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}]},{"id":"S9016","name":"Caminho","url":"https://attack.mitre.org/software/S9016","kind":"malware","description":"[Caminho](https://attack.mitre.org/software/S9016) can deobfuscate downloaded files prior to execution.(Citation: Zscaler BlindEagle DEC 2025)","relationship_id":"relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616","references":[{"source_name":"Zscaler BlindEagle DEC 2025","description":"Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"id":"S9018","name":"HeartCrypt","url":"https://attack.mitre.org/software/S9018","kind":"malware","description":"[HeartCrypt](https://attack.mitre.org/software/S9018) can decrypt payloads prior to execution.(Citation: Palo Alto HeartCrypt DEC 2024)(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--609f941d-2768-4e1f-9286-774a954a8bdb","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Palo Alto HeartCrypt DEC 2024","description":"Tujague, J., Bunce, D. (n.d.). Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation. Retrieved April 16, 2026.","url":"https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can decrypt downloaded resources and parse internal files to determine its settings.(Citation: Zscaler PureCrypter JUN 2022)(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--68166b59-ac4b-4bdc-928d-01e945611a5e","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9021","name":"DOWNIISSA","url":"https://attack.mitre.org/software/S9021","kind":"malware","description":"[DOWNIISSA](https://attack.mitre.org/software/S9021) can decode strings prior to execution.(Citation: Kaspersky LODEINFO OCT 2022)","relationship_id":"relationship--66c646e5-2364-4d26-bd03-56e5544553d3","references":[{"source_name":"Kaspersky LODEINFO OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) has the ability to decrypt its payload prior to execution.(Citation: ESET HiddenFace 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--e74df3d8-4609-4f07-bdb0-b0531b79038c","references":[{"source_name":"ESET HiddenFace 2024","description":"Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"},{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has decoded a XOR encoded private key.(Citation: JPCERT SPAWNCHIMERA Ivanti February 2025)","relationship_id":"relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0","references":[{"source_name":"JPCERT SPAWNCHIMERA Ivanti February 2025","description":"Yuma Masubuchi. (2025, February 20). SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can decrypt its payload prior to execution.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--39adf593-14d2-42c7-a9e3-957ada5ec5b1","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9026","name":"ROAMINGHOUSE","url":"https://attack.mitre.org/software/S9026","kind":"malware","description":"[ROAMINGHOUSE](https://attack.mitre.org/software/S9026) can decode and drop a malicious ZIP file prior to execution.(Citation: Trend Micro Earth Kasha Updates APR 2025)","relationship_id":"relationship--0bdfdf48-6d8b-4eeb-968d-fb3a73889d17","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","description":"Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}]},{"id":"S9027","name":"ANELLDR","url":"https://attack.mitre.org/software/S9027","kind":"malware","description":"[ANELLDR](https://attack.mitre.org/software/S9027) can decrypt encrypted payload data using AES-256-CBC and subsequently execute the payload in memory.(Citation: Trend Micro Earth Kasha Anel NOV 2024)\n","relationship_id":"relationship--3f55cf61-8cbe-48ac-904f-299030d02dc3","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}]},{"id":"S9028","name":"PHPsert","url":"https://attack.mitre.org/software/S9028","kind":"malware","description":"[PHPsert](https://attack.mitre.org/software/S9028) has the ability to decode and decrypt obfuscated strings prior to execution.(Citation: sentinelone operationDigitalEye Dec 2024)","relationship_id":"relationship--0133e2fc-5673-40a5-982b-9b0f441217f5","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","description":"Aleksandar Milenkoski, Luigi Martire. (2024, December 10). Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels. Retrieved February 27, 2025.","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}]},{"id":"S9029","name":"IronWind","url":"https://attack.mitre.org/software/S9029","kind":"malware","description":"[IronWind](https://attack.mitre.org/software/S9029) can deobfuscate the next stage payload using Base64 and XOR operations with the key \"53\".(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--ad472921-19b8-43ac-9b22-1ebb4f353b66","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"The [AshTag](https://attack.mitre.org/software/S9031) stager compoment can decode and decrypt Base64 and XOR-encrypted payloads.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--7b695677-86d7-4de6-bce7-970ac2207d77","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9032","name":"MuddyViper","url":"https://attack.mitre.org/software/S9032","kind":"malware","description":"[MuddyViper](https://attack.mitre.org/software/S9032) has decrypted the embedded HackBrowserData tool prior to execution.(Citation: ESET_MuddyWater_Dec2025)    ","relationship_id":"relationship--a8bf6c5d-6201-4d5e-883f-4818d721e247","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9033","name":"Fooder","url":"https://attack.mitre.org/software/S9033","kind":"malware","description":"[Fooder](https://attack.mitre.org/software/S9033) has decrypted payloads using the WinCrypt API and the AES key.(Citation: ESET_MuddyWater_Dec2025)    ","relationship_id":"relationship--e7c9e0f2-d1be-440b-9b6b-7273661d8dac","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9034","name":"Tsundere Botnet","url":"https://attack.mitre.org/software/S9034","kind":"malware","description":"[Tsundere Botnet](https://attack.mitre.org/software/S9034)’s loader has decrypted obfuscated JavaScript files using the AES-256 CBC algorithm, a build-specific key, and initialization vector.(Citation: SecureListUbiedo_Tsundere_Nov2025)(Citation: CAL_MuddyWater_Mar2026)   ","relationship_id":"relationship--da225cfe-1959-4faa-afef-b5c7a6555bba","references":[{"source_name":"CAL_MuddyWater_Mar2026","description":"Ctrl-Alt-Intel. (2026, March 4). MuddyWater Exposed: Inside an Iranian APT operation . Retrieved April 6, 2026.","url":"https://ctrlaltintel.com/research/MuddyWater/"},{"source_name":"SecureListUbiedo_Tsundere_Nov2025","description":"Ubiedo, L. (2025, November 20). Blockchain and Node.js abused by Tsundere: an emerging botnet. Retrieved April 6, 2026.","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can decode and drop a decoy file attached to spearphishing emails.(Citation: Splunk LAMEHUG SEP 2025)","relationship_id":"relationship--7cf769d6-3d2d-44a8-a8d0-dbf1da1f98d4","references":[{"source_name":"Splunk LAMEHUG SEP 2025","description":"Conteras, T., Splunk Research Team. (2025, September 25). From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion. Retrieved April 21, 2026.","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"}]},{"id":"S9036","name":"LP-Notes","url":"https://attack.mitre.org/software/S9036","kind":"malware","description":"[LP-Notes](https://attack.mitre.org/software/S9036) has decrypted strings with lengths ranging from 15 to 19 characters using the same decryption key for each string.(Citation: ESET_MuddyWater_Dec2025)","relationship_id":"relationship--3c7d55d0-6f53-4e2f-8504-9a298d275286","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has used the WriteHexToFile function to transform an embedded hex string to the payload CertificationKit.ini.(Citation: CloudSEK_RustyWater_Jan2026)   ","relationship_id":"relationship--c2e3c3ad-669a-4c20-8fd8-04626433a03c","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can deobfuscate an encoded Python script prior to execution.(Citation: Aqua Security Blog Trivy Compromise APR 2026)","relationship_id":"relationship--57388233-1b28-4ae4-b92b-f5eb7d47d6f0","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has decoded a long Base64 string to obtain a Python script for its second-stage payload.(Citation: Aikido TeamPCP Trivy MAR 2026)","relationship_id":"relationship--57861b9c-0d72-4c5d-8240-5fd038acf454","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","description":"Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has the ability to decrypt obfuscated payloads.(Citation: Trend Micro TeamPCP MAY 2026)","relationship_id":"relationship--887d8582-e9a4-4058-a917-4dea8dc3ab8c","references":[{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has used the AES-256-CBC algorithm to decrypt configuration files associated with the malware.(Citation: Claroty-IOCONTROL) (Citation: Dragos-2026-Year-In-Review)","relationship_id":"relationship--114934d2-1f35-461f-9a18-1ae434695b30","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Dragos-2026-Year-In-Review","description":"Dragos. (2026, February 17). Dragos 2026 OT/ICS Cybersecurity Report and Year in Review. Retrieved September 2, 2026.","url":"https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the function `CryptDecrypt`. Additionally, [Vidar](https://attack.mitre.org/software/S9050) has decoded the .data section using bitwise XOR operations.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has decoded its core code after confirming debugger and/or analysis tools.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--9021cef7-4b93-443c-a166-20a659fb6b56","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has decoded Base64-encoded tasks from the C2.(Citation: CheckPoint_NimbusManticore_May2026)","relationship_id":"relationship--657ef43d-5d67-4699-8308-0ec83ff16485","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]},{"id":"S9057","name":"CRASHPAD","url":"https://attack.mitre.org/software/S9057","kind":"malware","description":"[CRASHPAD](https://attack.mitre.org/software/S9057) has decrypted the config file ` C:\\Program Files\\VMware\\VMware Tools\\VMware VGAuth\\config.txt ` to move the contents to a newly created file called ` C:\\Program Files\\VMware\\VMware Tools\\VMware VGAuth\\crash.log `.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--1bb8999a-16c3-420d-8feb-65b104d18fd9","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9058","name":"SIGHTGRAB","url":"https://attack.mitre.org/software/S9058","kind":"malware","description":"[SIGHTGRAB](https://attack.mitre.org/software/S9058) has decrypted XOR-encrypted strings.(Citation: Mandiant_UNC1549_Nov2025) ","relationship_id":"relationship--ff66d5ca-9ce1-49bb-871a-8e5579c5bc3e","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has deobfuscated Base64-encoded shellcode strings prior to loading them.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--352e6e5a-f1e0-46f8-826a-978981f6d893","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"An [APT28](https://attack.mitre.org/groups/G0007) macro uses the command <code>certutil -decode</code> to decode contents of a .txt file storing the base64 encoded payload.(Citation: Unit 42 Sofacy Feb 2018)(Citation: Palo Alto Sofacy 06-2018)","relationship_id":"relationship--921c2a85-eab7-4cfc-9ac5-98a463262c17","references":[{"source_name":"Unit 42 Sofacy Feb 2018","description":"Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source_name":"Palo Alto Sofacy 06-2018","description":"Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or [PowerShell Profile](https://attack.mitre.org/techniques/T1546/013), to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--07516f04-c7aa-46c7-9cca-0f81b84043e2","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) has decrypted strings and imports using RC4 during execution.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)","relationship_id":"relationship--4b3f0b38-d4e2-49e8-a8f9-6a186c31967f","references":[{"source_name":"Securelist Darkhotel Aug 2015","description":"Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source_name":"Microsoft DUBNIUM July 2016","description":"Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"id":"G0021","name":"Molerats","url":"https://attack.mitre.org/groups/G0021","kind":"intrusion-set","description":"[Molerats](https://attack.mitre.org/groups/G0021) decompresses ZIP files once on the victim machine.(Citation: Kaspersky MoleRATs April 2019)","relationship_id":"relationship--497aec05-cb34-424d-943f-4fdfbf2585b4","references":[{"source_name":"Kaspersky MoleRATs April 2019","description":"GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"During execution, [Threat Group-3390](https://attack.mitre.org/groups/G0027) malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Securelist LuckyMouse June 2018)","relationship_id":"relationship--9191026d-2410-4e6d-98fe-26786a5b8bf1","references":[{"source_name":"Securelist LuckyMouse June 2018","description":"Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018.","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)","relationship_id":"relationship--ac47da26-22ae-43b9-947b-ed4ea6943d42","references":[{"source_name":"Qualys LolZarus","description":"Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034)'s VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)","relationship_id":"relationship--df98db39-fdfd-463c-96b3-e9a8b049f316","references":[{"source_name":"ESET Telebots Dec 2016","description":"Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source_name":"ESET Telebots July 2017","description":"Cherepanov, A.. (2017, July 4). Analysis of TeleBots’ cunning backdoor . Retrieved June 11, 2020.","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has used [certutil](https://attack.mitre.org/software/S0160) in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used <code>certutil -decode</code> to decode files on the victim’s machine when dropping [UPPERCUT](https://attack.mitre.org/software/S0275).(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)","relationship_id":"relationship--a6ddb76d-4317-4cfd-9e1d-57d8a0c5fb21","references":[{"source_name":"Accenture Hogfish April 2018","description":"Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"},{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated block of data with the key `qawsed1q2w3e`, which led to the installation of [Lizar](https://attack.mitre.org/software/S0681).(Citation: Gemini_FIN7_Jan2022) ","relationship_id":"relationship--94f5837a-6e62-4402-ad2e-b7ef7f3c60d9","references":[{"source_name":"Gemini_FIN7_Jan2022","description":"Gemini Advisory. (2022, January 13). FIN7 Uses Flash Drives to Spread Remote Access Trojan. Retrieved May 14, 2025.","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) tools decrypted additional payloads from the C2. [Gamaredon Group](https://attack.mitre.org/groups/G0047) has also decoded Base64-encoded source code of a downloader.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024)  Additionally, [Gamaredon Group](https://attack.mitre.org/groups/G0047) has decoded Telegram content to reveal the IP address for C2 communications.(Citation: unit42_gamaredon_dec2022)","relationship_id":"relationship--86bcc5c3-456e-4bac-a419-54f54af80325","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"TrendMicro Gamaredon April 2020","description":"Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"unit42_gamaredon_dec2022","description":"Unit 42. (2022, December 20). Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine. Retrieved September 12, 2024.","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"A [OilRig](https://attack.mitre.org/groups/G0049) macro has run a PowerShell command to decode file contents. [OilRig](https://attack.mitre.org/groups/G0049) has also used [certutil](https://attack.mitre.org/software/S0160) to decode base64-encoded files on victims.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Crowdstrike GTR2020 Mar 2020)","relationship_id":"relationship--67469b79-67e2-4932-9776-b09a82871723","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source_name":"OilRig New Delivery Oct 2017","description":"Falcone, R. and Lee, B. (2017, October 9). OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan. Retrieved January 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"},{"source_name":"Unit 42 OopsIE! Feb 2018","description":"Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Crowdstrike GTR2020 Mar 2020","description":"Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) downloads encoded payloads and decodes them on the victim.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--03303147-db81-4cb3-9368-98ee4f963c1a","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--bb870870-2dfb-4ff3-9e17-6a75476d9be4","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has decoded base64-encoded PowerShell, JavaScript, and VBScript.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater Jan 2022)","relationship_id":"relationship--58545f9a-d2cf-4466-bc7f-9cdbdce25d70","references":[{"source_name":"ClearSky MuddyWater Nov 2018","description":"ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source_name":"Talos MuddyWater Jan 2022","description":"Malhortra, A and Ventura, V. (2022, January 31). Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables. Retrieved June 22, 2022.","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source_name":"FireEye MuddyWater Mar 2018","description":"Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source_name":"MuddyWater TrendMicro June 2018","description":"Villanueva, M., Co, M. (2018, June 14). Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor. Retrieved July 3, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"}]},{"id":"G0073","name":"APT19","url":"https://attack.mitre.org/groups/G0073","kind":"intrusion-set","description":"An [APT19](https://attack.mitre.org/groups/G0073) HTTP malware variant decrypts strings using single-byte XOR keys.(Citation: Unit 42 C0d0so0 Jan 2016)","relationship_id":"relationship--f84b2658-a891-45a8-93ff-14dc0a86df10","references":[{"source_name":"Unit 42 C0d0so0 Jan 2016","description":"Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"id":"G0078","name":"Gorgon Group","url":"https://attack.mitre.org/groups/G0078","kind":"intrusion-set","description":"[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can decode contents from a payload that was Base64 encoded and write the contents to a file.(Citation: Unit 42 Gorgon Group Aug 2018)","relationship_id":"relationship--1b1e5d59-20a4-4915-a553-4db606d8121d","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","description":"Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) used shellcode with an XOR algorithm to decrypt a payload. [Tropic Trooper](https://attack.mitre.org/groups/G0081) also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--d68120b8-9ef8-4a40-ae4c-d2b597336140","references":[{"source_name":"Unit 42 Tropic Trooper Nov 2016","description":"Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used the RC4 algorithm to decrypt configuration data. (Citation: 1 - appv) [APT38](https://attack.mitre.org/groups/G0082) has decocoded Base64 encoded PowerShell scripts prior to execution.(Citation: MIcrosoft Mastra npm Compromise JUN 2026)","relationship_id":"relationship--3f2be4a4-b7fb-4845-af50-34ca28f03ab3","references":[{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"},{"source_name":"1 - appv","description":"SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--089eeb46-323e-410b-a27b-dc5ff4467c40","references":[{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"id":"G0090","name":"WIRTE","url":"https://attack.mitre.org/groups/G0090","kind":"intrusion-set","description":"[WIRTE](https://attack.mitre.org/groups/G0090) has used Base64 to decode malicious VBS script.(Citation: Lab52 WIRTE Apr 2019)","relationship_id":"relationship--19f9e4af-3ad9-4d0d-b4af-db145f514be9","references":[{"source_name":"Lab52 WIRTE Apr 2019","description":"S2 Grupo. (2019, April 2). WIRTE Group attacking the Middle East. Retrieved May 24, 2019.","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"id":"G0092","name":"TA505","url":"https://attack.mitre.org/groups/G0092","kind":"intrusion-set","description":"[TA505](https://attack.mitre.org/groups/G0092) has decrypted packed DLLs with an XOR key.(Citation: NCC Group TA505)","relationship_id":"relationship--8bba06f3-fac2-4484-a177-53d5716f80a6","references":[{"source_name":"NCC Group TA505","description":"Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.","url":"https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has decoded malicious VBScripts using Base64.(Citation: Talos Kimsuky Nov 2021) [Kimsuky](https://attack.mitre.org/groups/G0094) has also decoded malicious PowerShell scripts using Base64.(Citation: Securonix Kimsuky February 2025)(Citation: Aryaka Kimsuky July 2025) [Kimsuky](https://attack.mitre.org/groups/G0094) has decoded RC4 obfuscated files prior to downloading files from their infrastructure.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--1c7681f4-4dc4-4722-9fcc-a79712fe502e","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securonix Kimsuky February 2025","description":"Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025.","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) has extracted tar.gz files after downloading them from a C2 server.(Citation: Talos Rocke August 2018)","relationship_id":"relationship--c8fdab57-1e10-4f66-a1de-59a876c99ab1","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)","relationship_id":"relationship--fa22812f-01a4-420a-be11-7cb5822026e5","references":[{"source_name":"Malwarebytes Higaisa 2020","description":"Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"Zscaler Higaisa 2020","description":"Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.(Citation: Check Point APT31 February 2021)","relationship_id":"relationship--584bbe94-c7bf-4039-970c-545da4e2bf92","references":[{"source_name":"Check Point APT31 February 2021","description":"Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has the ability to decrypt its payload prior to execution.(Citation: Lab52 MUSTANG PANDA PUBLOAD MAY 2023)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos Mustang Panda PLUGX) [Mustang Panda](https://attack.mitre.org/groups/G0129) has also utilized RC4 encryption for malicious payloads.(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)(Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79","references":[{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","description":"Dex. (n.d.). New Mustang Panda’s campaing against Australia. Retrieved August 4, 2025.","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"EclecticIQ Mustang Panda PlugX","description":"EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025.","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","description":"Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used a script that decodes a Base64-encoded version of WeaveWorks Scope.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--9a74aca4-4a5e-4a12-bd98-6a4d2df1b1a1","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) has used [certutil](https://attack.mitre.org/software/S0160) to decode a string into a cabinet file.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--52a5b303-b759-424e-86b8-5c855976e5ea","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has utilized `certutil` to decode base64 encoded versions of custom malware.(Citation: Mandiant FIN13 Aug 2022)","relationship_id":"relationship--d7702458-8b9d-49e8-a494-b5d87681f2c5","references":[{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used Base64-encoded data to transfer payloads and commands, including deobfuscation via [certutil](https://attack.mitre.org/software/S0160).(Citation: Secureworks BRONZE SILHOUETTE May 2023)","relationship_id":"relationship--42f5a98f-bf34-4b60-ac0c-dfca896c8235","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"id":"G1021","name":"Cinnamon Tempest","url":"https://attack.mitre.org/groups/G1021","kind":"intrusion-set","description":"[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has used weaponized DLLs to load and decrypt payloads.(Citation: Sygnia Emperor Dragonfly October 2022)","relationship_id":"relationship--beee667c-c63d-48c9-86c1-54a50081199d","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","description":"Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"id":"G1026","name":"Malteiro","url":"https://attack.mitre.org/groups/G1026","kind":"intrusion-set","description":"[Malteiro](https://attack.mitre.org/groups/G1026) has the ability to deobfuscate downloaded files prior to execution.(Citation: SCILabs Malteiro 2021)","relationship_id":"relationship--e3d05599-2a5f-4357-b452-49309690eab1","references":[{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) has deployed base64-encoded variants of [ASPXSpy](https://attack.mitre.org/software/S0073) to evade detection.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--347aa8dd-7fb9-45b0-9472-6894b881ebf1","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) delivered exploit payloads via base64-encoded payloads in malicious email messages.(Citation: ESET WinterVivern 2023)","relationship_id":"relationship--9ac9c832-68cb-48ce-85eb-f0b8334fe48d","references":[{"source_name":"ESET WinterVivern 2023","description":"Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024.","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--2310666c-87e1-45ae-bac8-2255215e858a","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has encoded commands in base64-encoded sections concatenated together in PowerShell.(Citation: FBI BlackByte 2022) [BlackByte](https://attack.mitre.org/groups/G1043) uses PowerShell commands to disable Windows Defender.(Citation: Picus BlackByte 2022)","relationship_id":"relationship--b2d68c37-be6c-49e4-917a-3a8e22a97e54","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1046","name":"Storm-1811","url":"https://attack.mitre.org/groups/G1046","kind":"intrusion-set","description":"[Storm-1811](https://attack.mitre.org/groups/G1046) has distributed password-protected archives such as ZIP files during intrusions.(Citation: rapid7-email-bombing)","relationship_id":"relationship--568ad9ef-8cbc-4274-b99e-a33c455096cb","references":[{"source_name":"rapid7-email-bombing","description":"Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]}],"mitigations":[],"candidates":[{"id":"005943f9-8dd5-4349-8b46-0313c0a9f973","name":"Hex decoding with shell utilities","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Use common shell utilities to decode a hex-encoded text string and echo it to the console\n","inputs":{"message":{"description":"Message to print to the screen","type":"string","default":"Hello from Atomic Red Team test T1140!"},"encoded_file":{"description":"File to temporarily save encoded text","type":"path","default":"/tmp/T1140.encoded"}},"dependencies":[{"description":"xxd must be present\n"}],"source_definition_sha256":"0f16807d36dc5d947e9a2bf22cea3e34922337f38fb7f658bfe973b4819b6876"},{"id":"18ee2002-66e8-4518-87c5-c0ec9c8299ac","name":"FreeBSD b64encode Shebang in CLI","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Using b64decode shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml) for it. \n","inputs":{"bash_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Jhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"dash_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"fish_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"sh_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL3NoCmVjaG8gImh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL0BhdG9taWNzb25hZnJpZGF5IEZUVyIK"}},"dependencies":[{"description":"b64decode must be present\n"}],"source_definition_sha256":"3f9202b809293d322f739fad75aaae41bbb44844b2969c799904bd985db3f8f9"},{"id":"356dc0e8-684f-4428-bb94-9313998ad608","name":"Base64 decoding with Python","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Use Python to decode a base64-encoded text string and echo it to the console\n","inputs":{"message":{"description":"Message to print to the screen","type":"string","default":"Hello from Atomic Red Team test T1140!"},"encoded_file":{"description":"File to temporarily save encoded text","type":"path","default":"/tmp/T1140.encoded"}},"dependencies":[{"description":"Python must be present\n"}],"source_definition_sha256":"4e3b0352bbbb291a45f6ec949d8e1444dbd92bd804a4208b13180b266cffea11"},{"id":"3a15c372-67c1-4430-ac8e-ec06d641ce4d","name":"Linux Base64 Encoded Shebang in CLI","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Using Linux Base64 Encoded shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen [here](https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html) by TrendMicro, as well as [LinPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS). Also a there is a great Sigma rule [here](https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml) for it. \n","inputs":{"bash_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Jhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"dash_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"fish_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo="},"sh_encoded":{"description":"Encoded","type":"string","default":"IyEvYmluL3NoCmVjaG8gImh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL0BhdG9taWNzb25hZnJpZGF5IEZUVyIK"}},"dependencies":[{"description":"base64 must be present\n"}],"source_definition_sha256":"8026361e2d25dc5627aa1f33938a0ba7f2d94bc130efe5d13e86416d11627bdb"},{"id":"6604d964-b9f6-4d4b-8ce8-499829a14d0a","name":"Base64 decoding with Perl","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Use Perl to decode a base64-encoded text string and echo it to the console    \n","inputs":{"message":{"description":"Message to print to the screen","type":"string","default":"Hello from Atomic Red Team test T1140!"},"encoded_file":{"description":"File to temporarily save encoded text","type":"path","default":"/tmp/T1140.encoded"}},"dependencies":[{"description":"Perl must be present\n"}],"source_definition_sha256":"df92c5b6fde45b52d77d1ba2dbced7140cc3afeeee8ea8103486542836a05d14"},{"id":"71abc534-3c05-4d0c-80f7-cbe93cb2aa94","name":"Certutil Rename and Decode","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Rename certutil and decode a file. This is in reference to latest research by FireEye [here](https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html)\n","inputs":{"executable":{"description":"name of executable/file to decode","type":"path","default":"C:\\Windows\\System32\\calc.exe"}},"dependencies":[],"source_definition_sha256":"36615ae4ad122c077e547b3087275b81ef97ef46efc94edf864031d23a36faab"},{"id":"9f8b1c54-cb76-4d5e-bb1f-2f5c0e8f5a11","name":"Expand CAB with expand.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives.\nUpon success, art-expand-source.txt is extracted next to the CAB.\n","inputs":{"cab_path":{"description":"Path to the CAB to expand (created if missing)","type":"path","default":"%TEMP%\\art-expand-test.cab"},"output_dir":{"description":"Destination directory","type":"path","default":"%TEMP%\\art-expand-out"}},"dependencies":[],"source_definition_sha256":"d33bff3fa31987f0c81461e78a9e80b7d5ff903d0261e2bfd7b3c3684edfbf35"},{"id":"b4f6a567-a27a-41e5-b8ef-ac4b4008bb7e","name":"Base64 decoding with shell utilities","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Use common shell utilities to decode a base64-encoded text string and echo it to the console\n","inputs":{"message":{"description":"Message to print to the screen","type":"string","default":"Hello from Atomic Red Team test T1140!"},"encoded_file":{"description":"File to temporarily save encoded text","type":"path","default":"/tmp/T1140.encoded"}},"dependencies":[],"source_definition_sha256":"9e9e95876658ace6e94666c6968254638f87ea4dec5405d93209e674bf3a4275"},{"id":"b6097712-c42e-4174-b8f2-4b1e1a5bbb3d","name":"Base64 decoding with shell utilities (freebsd)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Use common shell utilities to decode a base64-encoded text string and echo it to the console\n","inputs":{"message":{"description":"Message to print to the screen","type":"string","default":"Hello from Atomic Red Team test T1140!"},"encoded_file":{"description":"File to temporarily save encoded text","type":"path","default":"/tmp/T1140.encoded"}},"dependencies":[],"source_definition_sha256":"62d7b1d5aee66384439240568b0c178477d71b0aff36d5900f2250dec2532c85"},{"id":"c3b65cd5-ee51-4e98-b6a3-6cbdec138efc","name":"XOR decoding and command execution using Python","platforms":["linux","macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"An adversary can obfuscate malicious commands or payloads using XOR and execute them on the victim's machine. This test uses Python to decode and execute commands on the machine.","inputs":{"xor_key":{"description":"Key used to decrypt the command ","type":"string","default":"waEHleblxiQjoxFJQaIMLdHKz"},"encrypted_command":{"description":"Encrypted command that will be executed","type":"string","default":"AAkqKQEM"}},"dependencies":[{"description":"Python3 must be installed"}],"source_definition_sha256":"fc7b9ea9d07e779dc069c2dd871db2628cf5ffd83936b6f458662cc8556697de"},{"id":"dc6fe391-69e6-4506-bd06-ea5eeb4082f8","name":"Deobfuscate/Decode Files Or Information","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml","description":"Encode/Decode executable\nUpon execution a file named T1140_calc_decoded.exe will be placed in the temp folder\n","inputs":{"executable":{"description":"name of executable","type":"path","default":"C:\\Windows\\System32\\calc.exe"}},"dependencies":[],"source_definition_sha256":"d3e65d591c0957933b2c2af7268f8fa0c43480e3a25c22f2becb5816d675f56e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1027":"/ttp-simulation/techniques/enterprise/T1027/","T1204":"/ttp-simulation/techniques/enterprise/T1204/","T1140":"/ttp-simulation/techniques/enterprise/T1140/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1546.013":"/ttp-simulation/techniques/enterprise/T1546.013/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1140","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}