- S0011 Taidoor — malware.
Taidoor can use a stream cipher to decrypt stings used by the malware.[CISA MAR-10292089-1.v2 TAIDOOR August 2021]
Exact relationship: relationship--5b928b39-ce48-47b8-82bc-d4ec63b1e3f4 - S0013 PlugX — malware.
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.[CIRCL PlugX March 2013][Trend Micro DRBControl February 2020][Proofpoint TA416 Europe March 2022] PlugX has also decrypted its payloads in memory.[Eset PlugX Korplug Mustang Panda March 2022][Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022][EclecticIQ Mustang Panda PlugX][Sophos Mustang Panda PLUGX]
Exact relationship: relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0 - S0022 Uroburos — malware.
Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.[Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023]
Exact relationship: relationship--d1b6a397-4f29-4274-8394-1d5ca4fe9fc7 - S0024 Dyre — malware.
Dyre decrypts resources needed for targeting the victim.[Symantec Dyre June 2015][Malwarebytes Dyreza November 2015]
Exact relationship: relationship--6d1074cb-a9eb-4237-b8b2-d823cfa1408b - S0032 gh0st RAT — malware.
gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.[Gh0stRAT ATT March 2019]
Exact relationship: relationship--8631491d-bda8-4eee-93ec-5f3fc6340c3f - S0052 OnionDuke — malware.
OnionDuke can use a custom decryption algorithm to decrypt strings.[ESET Dukes October 2019]
Exact relationship: relationship--e1fba82d-1cd2-4906-92db-ba3aafad72ca - S0115 Crimson — malware.
Crimson can decode its encoded PE file prior to execution.[Proofpoint Operation Transparent Tribe March 2016]
Exact relationship: relationship--4ffef54e-be6b-40cf-9446-d886f298d79c - S0126 ComRAT — malware.
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.[ESET ComRAT May 2020][CISA ComRAT Oct 2020]
Exact relationship: relationship--ad8fdfa4-5e0b-437d-9723-9bc5a272f465 - S0127 BBSRAT — malware.
BBSRAT uses Expand to decompress a CAB file into executable content.[Palo Alto Networks BBSRAT]
Exact relationship: relationship--128e8365-7645-41fa-832e-5ff4d8639035 - S0140 Shamoon — malware.
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.[Unit 42 Shamoon3 2018]
Exact relationship: relationship--8fe32611-4206-4bef-9698-dbcefde08090 - S0141 Winnti for Windows — malware.
The Winnti for Windows dropper can decrypt and decompresses a data blob.[Novetta Winnti April 2015]
Exact relationship: relationship--d99ad754-c9fa-4244-b4fa-69a0b2191e24 - S0147 Pteranodon — malware.
Pteranodon can decrypt encrypted data strings prior to using them.[Microsoft Actinium February 2022]
Exact relationship: relationship--7ce7aa48-afa9-4eb6-8bc2-8f04fd6cf00e - S0154 Cobalt Strike — malware.
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.[Talos Cobalt Strike September 2020][Cobalt Strike Manual 4.3 November 2020] The Cobalt Strike loader component can also decrypt the .bss section of the Beacon binary prior to execution.[Cisco Talos Qilin Ransomware OCT 2025]
Exact relationship: relationship--b1065110-5387-4dee-b27e-f671d75f403f - S0160 certutil — tool.
certutil has been used to decode binaries hidden inside certificate files as Base64 information.[Malwarebytes Targeted Attack against Saudi Arabia]
Exact relationship: relationship--5918cee6-c2f1-41be-ab96-36f3d17e5293 - S0180 Volgmer — malware.
Volgmer deobfuscates its strings and APIs once its executed.[US-CERT Volgmer 2 Nov 2017]
Exact relationship: relationship--fd2f1a44-2ae7-4df0-b53c-42bc96af2da1 - S0182 FinFisher — malware.
FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.[FinFisher Citation][Microsoft FinFisher March 2018]
Exact relationship: relationship--d4bffc31-3d7a-4f05-a85d-fdaaaa70853d - S0188 Starloader — malware.
Starloader decrypts and executes shellcode from a file called Stars.jps.[Symantec Sowbug Nov 2017]
Exact relationship: relationship--283bdd5f-f356-43a2-864c-6f8211073d45 - S0189 ISMInjector — malware.
ISMInjector uses the <code>certutil</code> command to decode a payload file.[OilRig New Delivery Oct 2017]
Exact relationship: relationship--566d783a-2d86-4b9a-8ca0-5013de5f7fb4 - S0196 PUNCHBUGGY — malware.
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.[Morphisec ShellTea June 2019]
Exact relationship: relationship--bdd9a384-2d57-4238-bddd-5500e667d620 - S0223 POWERSTATS — malware.
POWERSTATS can deobfuscate the main backdoor code.[ClearSky MuddyWater Nov 2018]
Exact relationship: relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f - S0226 Smoke Loader — malware.
Smoke Loader deobfuscates its code.[Talos Smoke Loader July 2018]
Exact relationship: relationship--0c4af99b-e82d-422f-86da-ccc94e55d763 - S0230 ZeroT — malware.
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.[Proofpoint ZeroT Feb 2017]
Exact relationship: relationship--026a63ae-dd3d-4ea6-8a32-c40c9b37b893 - S0234 Bandook — malware.
Bandook has decoded its PowerShell script.[CheckPoint Bandook Nov 2020]
Exact relationship: relationship--ebd78850-caf0-4e14-8338-0f7347063afc - S0236 Kwampirs — malware.
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.[Symantec Orangeworm April 2018]
Exact relationship: relationship--2d822996-4574-402d-8d0f-1cfc0e963850 - S0239 Bankshot — malware.
Bankshot decodes embedded XOR strings.[US-CERT Bankshot Dec 2017]
Exact relationship: relationship--5412525e-cba5-4fa1-89ff-7e6fa2b92e24 - S0240 ROKRAT — malware.
ROKRAT can decrypt strings using the victim's hostname as the key.[Volexity InkySquid RokRAT August 2021][Malwarebytes RokRAT VBA January 2021]
Exact relationship: relationship--959092cf-5647-4c25-b64e-3e84061511a5 - S0251 Zebrocy — malware.
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.[Unit42 Cannon Nov 2018][ESET Zebrocy Nov 2018]
Exact relationship: relationship--e3be5269-92fd-488e-be35-ddc91030f7c3 - S0255 DDKONG — malware.
DDKONG decodes an embedded configuration using XOR.[Rancor Unit42 June 2018]
Exact relationship: relationship--309652a1-45a4-4479-9e84-dfab33d0a1f5 - S0257 VERMIN — malware.
VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.[Unit 42 VERMIN Jan 2018]
Exact relationship: relationship--54c703f9-67ef-4622-afed-0ebbd2563e9e - S0258 RGDoor — malware.
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.[Unit 42 RGDoor Jan 2018]
Exact relationship: relationship--d4240d9a-1499-4863-a654-a52a1dbf48b4 - S0260 InvisiMole — malware.
InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.[ESET InvisiMole June 2018][ESET InvisiMole June 2020]
Exact relationship: relationship--b6a89ded-fa53-42b9-8f40-03c845123ac0 - S0263 TYPEFRAME — malware.
One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".[US-CERT TYPEFRAME June 2018]
Exact relationship: relationship--77b9e1c5-8241-4260-8125-4bc2e1206b9c - S0264 OopsIE — malware.
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.[Unit 42 OopsIE! Feb 2018]
Exact relationship: relationship--3cd2c187-587c-4969-957d-122ce654fc2a - S0266 TrickBot — malware.
TrickBot decodes the configuration data and modules.[Fidelis TrickBot Oct 2016][Cyberreason Anchor December 2019][Joe Sec Trickbot]
Exact relationship: relationship--af7c56df-ced8-45b7-9aef-be1039e30cea - S0268 Bisonal — malware.
Bisonal has decoded strings in the malware using XOR and RC4.[Unit 42 Bisonal July 2018][Talos Bisonal Mar 2020]
Exact relationship: relationship--49f9b769-57d1-4d73-8194-59b584a72c1b - S0269 QUADAGENT — malware.
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.[Unit 42 QUADAGENT July 2018]
Exact relationship: relationship--198cddce-40f7-43eb-aeac-60171f111065 - S0270 RogueRobin — malware.
RogueRobin decodes an embedded executable using base64 and decompresses it.[Unit42 DarkHydrus Jan 2019]
Exact relationship: relationship--f304b74c-85c7-4bd6-85bc-bec918a4fb7e - S0279 Proton — malware.
Proton uses an encrypted file to store commands and configuration values.[objsee mac malware 2017]
Exact relationship: relationship--8183d862-5383-4a42-acbd-be58e120cb25 - S0280 MirageFox — malware.
MirageFox has a function for decrypting data containing C2 configuration information.[APT15 Intezer June 2018]
Exact relationship: relationship--f16f0b46-3363-48bd-9a13-c8751fdedf1c - S0284 More_eggs — malware.
More_eggs will decode malware components that are then dropped to the system.[Security Intelligence More Eggs Aug 2019]
Exact relationship: relationship--095f6266-2535-4991-ad6b-64388513d6e7 - S0330 Zeus Panda — malware.
Zeus Panda decrypts strings in the code during the execution process.[Talos Zeus Panda Nov 2017]
Exact relationship: relationship--e6aed3c5-9f4a-4178-b03b-5805b2f61c81 - S0331 Agent Tesla — malware.
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.[Malwarebytes Agent Tesla April 2020]
Exact relationship: relationship--a4105315-b63d-47c9-9526-3dd388d892b4 - S0335 Carbon — malware.
Carbon decrypts task and configuration files for execution.[ESET Carbon Mar 2017][Accenture HyperStack October 2020]
Exact relationship: relationship--848313af-f9c3-4b51-a24a-d2e88487ab53 - S0344 Azorult — malware.
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.[Unit42 Azorult Nov 2018][Proofpoint Azorult July 2018]
Exact relationship: relationship--3733dda5-9dd9-43d1-ac3a-24f1b5fb86e7 - S0347 AuditCred — malware.
AuditCred uses XOR and RC4 to perform decryption on the code functions.[TrendMicro Lazarus Nov 2018]
Exact relationship: relationship--d98b5525-3cc5-4058-baf5-d614b91eb814 - S0348 Cardinal RAT — malware.
Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.[PaloAlto CardinalRat Apr 2017]
Exact relationship: relationship--bfe474ce-d88f-4372-9918-a04470ba080e - S0352 OSX_OCEANLOTUS.D — malware.
OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.[Unit42 OceanLotus 2017]
Exact relationship: relationship--4ca73e82-4e56-4044-a21a-d613a80f171c - S0353 NOKKI — malware.
NOKKI uses a unique, custom de-obfuscation technique.[Unit 42 NOKKI Sept 2018]
Exact relationship: relationship--be07fb4e-06db-4bb0-a1e0-23f34b24a97f - S0354 Denis — malware.
Denis will decrypt important strings used for C&C communication.[Cybereason Cobalt Kitty 2017]
Exact relationship: relationship--33d24077-13af-4e14-ba79-87ca145c5383 - S0355 Final1stspy — malware.
Final1stspy uses Python code to deobfuscate base64-encoded strings.[Unit 42 Nokki Oct 2018]
Exact relationship: relationship--347ee2ed-7def-45ac-9935-063a679859ae - S0356 KONNI — malware.
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.[Medium KONNI Jan 2020][Malwarebytes Konni Aug 2021]
Exact relationship: relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46 - S0361 Expand — tool.
Expand can be used to decompress a local or remote CAB file into an executable.[Microsoft Expand Utility]
Exact relationship: relationship--31fa2481-0b4f-40d4-b438-1d04a7eb0888 - S0367 Emotet — malware.
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.[Binary Defense Emotes Wi-Fi Spreader]
Exact relationship: relationship--7e4db234-1923-4bfb-ab32-284f31182c76 - S0369 CoinTicker — malware.
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.[CoinTicker 2019]
Exact relationship: relationship--a6944696-304c-4813-8285-56275e926f9f - S0373 Astaroth — malware.
Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code. [Cybereason Astaroth Feb 2019][Securelist Brazilian Banking Malware July 2020]
Exact relationship: relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b - S0375 Remexi — malware.
Remexi decrypts the configuration data using XOR with 25-character keys.[Securelist Remexi Jan 2019]
Exact relationship: relationship--85b0be36-c9fb-4359-b9b6-4e13300e374b - S0377 Ebury — malware.
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.[ESET Ebury Oct 2017]
Exact relationship: relationship--4800e509-0653-4895-a9f0-e0b538592875 - S0386 Ursnif — malware.
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.[ProofPoint Ursnif Aug 2016]
Exact relationship: relationship--6ee02f06-6250-4c75-b20f-c3271442f59e - S0388 YAHOYAH — malware.
YAHOYAH decrypts downloaded files before execution.[TrendMicro TropicTrooper 2015]
Exact relationship: relationship--74e1dbd9-baad-488f-9b30-4430420e15d3 - S0390 SQLRat — malware.
SQLRat has scripts that are responsible for deobfuscating additional scripts.[Flashpoint FIN 7 March 2019]
Exact relationship: relationship--b7f13afc-0e1c-4142-b05c-def10c17a8d6 - S0394 HiddenWasp — malware.
HiddenWasp uses a cipher to implement a decoding function.[Intezer HiddenWasp Map 2019]
Exact relationship: relationship--b6df63b7-34af-4918-8d1d-cf3dad0287f8 - S0395 LightNeuron — malware.
LightNeuron has used AES and XOR to decrypt configuration files and commands.[ESET LightNeuron May 2019]
Exact relationship: relationship--54d9e07f-eff6-41e9-8821-3bb7ac657c8c - S0398 HyperBro — malware.
HyperBro can unpack and decrypt its payload prior to execution.[Trend Micro DRBControl February 2020][Trend Micro Iron Tiger April 2021]
Exact relationship: relationship--6cb89bfe-73f6-47d8-beb5-f8b2d66e0bfd - S0401 Exaramel for Linux — malware.
Exaramel for Linux can decrypt its configuration file.[ANSSI Sandworm January 2021]
Exact relationship: relationship--6f64c3b9-7882-4bcf-9ff2-3dcce03cf632 - S0402 OSX/Shlayer — malware.
OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.[Carbon Black Shlayer Feb 2019] Versions of OSX/Shlayer pass encrypted and password-protected code to <code>openssl</code> and then write the payload to the <code>/tmp</code> folder.[sentinelone shlayer to zshlayer][20 macOS Common Tools and Techniques]
Exact relationship: relationship--8a2fbf8a-a05c-44d7-a270-afe092de9db5 - S0409 Machete — malware.
Machete’s downloaded data is decrypted using AES.[ESET Machete July 2019]
Exact relationship: relationship--075c6890-45e1-495e-a83e-b81ab05a8b4e - S0414 BabyShark — malware.
BabyShark has the ability to decode downloaded files prior to execution.[CISA AA20-301A Kimsuky]
Exact relationship: relationship--843aedaa-bbf0-4f29-bcfd-bd226ca7ef31 - S0415 BOOSTWRITE — malware.
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.[FireEye FIN7 Oct 2019]
Exact relationship: relationship--07bbfaa8-c62f-4abc-845c-55b28434d058 - S0428 PoetRAT — malware.
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.[Talos PoetRAT October 2020]
Exact relationship: relationship--df0ee75f-5e10-40d7-a0ac-e6c281e0d4b9 - S0430 Winnti for Linux — malware.
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.[Chronicle Winnti for Linux May 2019]
Exact relationship: relationship--45e9de66-7203-48e9-bd9b-096c289f35db - S0434 Imminent Monitor — tool.
Imminent Monitor has decoded malware components that are then dropped to the system.[QiAnXin APT-C-36 Feb2019]
Exact relationship: relationship--239cb026-369a-43f0-922c-cdc38d124430 - S0436 TSCookie — malware.
TSCookie has the ability to decrypt, load, and execute a DLL and its resources.[JPCert TSCookie March 2018]
Exact relationship: relationship--2b062058-3345-4993-9715-6ad6e98dc2ad - S0439 Okrum — malware.
Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.[ESET Okrum July 2019]
Exact relationship: relationship--b3f66735-fafe-49be-b55c-4d087d1351a7 - S0443 MESSAGETAP — malware.
After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files. [FireEye MESSAGETAP October 2019]
Exact relationship: relationship--97323d60-9623-4b3e-8ff9-50370fef4e5b - S0444 ShimRat — malware.
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.[FOX-IT May 2016 Mofang]
Exact relationship: relationship--980a5f66-14d7-42c6-82f7-ef96cbab77bb - S0447 Lokibot — malware.
Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.[Talos Lokibot Jan 2021]
Exact relationship: relationship--13bc2a82-c51d-4410-9e62-223df287b8f7 - S0448 Rising Sun — malware.
Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.[McAfee Sharpshooter December 2018]
Exact relationship: relationship--4f89d6c4-29ec-4777-bbc9-b0ea78064c42 - S0455 Metamorfo — malware.
Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.[Medium Metamorfo Apr 2020][FireEye Metamorfo Apr 2018][ESET Casbaneiro Oct 2019]
Exact relationship: relationship--f264330f-3c9f-4a2a-a6f6-904a9139bbf5 - S0456 Aria-body — malware.
Aria-body has the ability to decrypt the loader configuration and payload DLL.[CheckPoint Naikon May 2020]
Exact relationship: relationship--26303f07-87f0-4740-b6ea-e81e8c01b267 - S0457 Netwalker — malware.
Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.[Sophos Netwalker May 2020]
Exact relationship: relationship--3967e156-2135-4416-b3c3-79372d19d610 - S0458 Ramsay — malware.
Ramsay can extract its agent from the body of a malicious document.[Eset Ramsay May 2020]
Exact relationship: relationship--ed6d663f-510b-4702-9c2a-ef40cc4d88c7 - S0461 SDBbot — malware.
SDBbot has the ability to decrypt and decompress its payload to enable code execution.[Proofpoint TA505 October 2019][IBM TA505 April 2020]
Exact relationship: relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab - S0466 WindTail — malware.
WindTail has the ability to decrypt strings using hard-coded AES keys.[objective-see windtail1 dec 2018]
Exact relationship: relationship--b4016d43-d8c4-4ca2-b119-0681ebe8aaff - S0468 Skidmap — malware.
Skidmap has the ability to download, unpack, and decrypt tar.gz files .[Trend Micro Skidmap]
Exact relationship: relationship--952412b3-a7b1-402c-a92e-96830df4d14b - S0469 ABK — malware.
ABK has the ability to decrypt AES encrypted payloads.[Trend Micro Tick November 2019]
Exact relationship: relationship--3c8467e6-0878-4c62-afe6-55f124872089 - S0470 BBK — malware.
BBK has the ability to decrypt AES encrypted payloads.[Trend Micro Tick November 2019]
Exact relationship: relationship--7562ef46-c452-4338-9e06-3afdcf2c0e04 - S0473 Avenger — malware.
Avenger has the ability to decrypt files downloaded from C2.[Trend Micro Tick November 2019]
Exact relationship: relationship--70b94aa6-7cf1-4cf5-b00b-aed156036f1e - S0475 BackConfig — malware.
BackConfig has used a custom routine to decrypt strings.[Unit 42 BackConfig May 2020]
Exact relationship: relationship--e823be4b-50b9-4430-9010-e960b46bdfcc - S0476 Valak — malware.
Valak has the ability to decode and decrypt downloaded files.[Cybereason Valak May 2020][Unit 42 Valak July 2020]
Exact relationship: relationship--b99e218f-942b-4643-b4de-35649d2a4cbd - S0477 Goopy — malware.
Goopy has used a polymorphic decryptor to decrypt itself at runtime.[Cybereason Cobalt Kitty 2017]
Exact relationship: relationship--c9aa1bb6-874a-4de6-84c8-e1e9d1d112d0 - S0482 Bundlore — malware.
Bundlore has used <code>openssl</code> to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.[MacKeeper Bundlore Apr 2019]
Exact relationship: relationship--68cfc5f9-3c65-4f24-8018-cf811d7b6c9f - S0487 Kessel — malware.
Kessel has decrypted the binary's configuration once the <code>main</code> function was launched.[ESET ForSSHe December 2018]
Exact relationship: relationship--54e76e33-91b4-409f-a784-7e181f82b216 - S0492 CookieMiner — malware.
CookieMiner has used Google Chrome's decryption and extraction operations.[Unit42 CookieMiner Jan 2019]
Exact relationship: relationship--8bed4012-0b27-409b-8236-1b5238dd477d - S0495 RDAT — malware.
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.[Unit42 RDAT July 2020]
Exact relationship: relationship--63b6fd1d-65a7-4c94-8045-16fd198802f1 - S0496 REvil — malware.
REvil can decode encrypted strings to enable execution of commands and payloads.[G Data Sodinokibi June 2019][Kaspersky Sodin July 2019][Cylance Sodinokibi July 2019][McAfee Sodinokibi October 2019][Intel 471 REvil March 2020][Secureworks REvil September 2019]
Exact relationship: relationship--a0ff37b8-1a73-45dd-a645-fe2a43fad9f6 - S0499 Hancitor — malware.
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.[Threatpost Hancitor][FireEye Hancitor]
Exact relationship: relationship--ffecf9e6-6966-4535-934f-4fd4696875b0 - S0501 PipeMon — malware.
PipeMon can decrypt password-protected executables.[ESET PipeMon May 2020]
Exact relationship: relationship--d2bc4516-c074-4d44-9931-07ab518de60a - S0502 Drovorub — malware.
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.[NSA/FBI Drovorub August 2020]
Exact relationship: relationship--994846d3-7130-4374-bd6e-278ad870fa94 - S0511 RegDuke — malware.
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.[ESET Dukes October 2019]
Exact relationship: relationship--8ea64034-60a6-466d-9434-19d05180626c - S0512 FatDuke — malware.
FatDuke can decrypt AES encrypted C2 communications.[ESET Dukes October 2019]
Exact relationship: relationship--fbe5352c-7c4f-437c-a439-d212ba6d439b - S0513 LiteDuke — malware.
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.[ESET Dukes October 2019]
Exact relationship: relationship--0575a941-3af6-4b7b-93df-30f6001760ac - S0514 WellMess — malware.
WellMess can decode and decrypt data received from C2.[PWC WellMess July 2020][PWC WellMess C2 August 2020][CISA WellMess July 2020]
Exact relationship: relationship--c958d98c-d3d9-40cf-9702-5d9cb2cdf719 - S0515 WellMail — malware.
WellMail can decompress scripts received from C2.[CISA WellMail July 2020]
Exact relationship: relationship--a511a41e-0ab0-4088-8617-5de975b5d9a8 - S0516 SoreFang — malware.
SoreFang can decode and decrypt exfiltrated data sent to C2.[CISA SoreFang July 2016]
Exact relationship: relationship--ec218695-e481-4895-97a2-5383949cb04d - S0517 Pillowmint — malware.
Pillowmint has been decompressed by included shellcode prior to being launched.[Trustwave Pillowmint June 2020]
Exact relationship: relationship--abece522-51dc-4904-b0f9-585db7fb0223 - S0518 PolyglotDuke — malware.
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.[ESET Dukes October 2019]
Exact relationship: relationship--fe2eb5b7-7ae1-4df1-a49e-ad13f50510e8 - S0520 BLINDINGCAN — malware.
BLINDINGCAN has used AES and XOR to decrypt its DLLs.[US-CERT BLINDINGCAN Aug 2020]
Exact relationship: relationship--ea027248-40a2-403b-a0e9-748bdc8c5667 - S0526 KGH_SPY — malware.
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.[Cybereason Kimsuky November 2020]
Exact relationship: relationship--f2cb5393-d33f-4ee3-a2c0-197c1e032ea5 - S0531 Grandoreiro — malware.
Grandoreiro can decrypt its encrypted internal strings.[ESET Grandoreiro April 2020]
Exact relationship: relationship--ade847d9-4ce6-4b63-accb-7070c926e5b5 - S0532 Lucifer — malware.
Lucifer can decrypt its C2 address upon execution.[Unit 42 Lucifer June 2020]
Exact relationship: relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3 - S0534 Bazar — malware.
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.[Cybereason Bazar July 2020][NCC Group Team9 June 2020]
Exact relationship: relationship--d9e7b8b3-6275-4c26-b9d2-4adfa1143c1b - S0543 Spark — malware.
Spark has used a custom XOR algorithm to decrypt the payload.[Unit42 Molerat Mar 2020]
Exact relationship: relationship--b1a30826-465a-4342-8ceb-e0bd4ef50063 - S0546 SharpStage — malware.
SharpStage has decompressed data received from the C2 server.[BleepingComputer Molerats Dec 2020]
Exact relationship: relationship--a6bf495a-9769-433b-8754-e57f5e9045b7 - S0547 DropBook — malware.
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.[Cybereason Molerats Dec 2020]
Exact relationship: relationship--8e2b7383-c6dc-40c1-bb88-3176ff98c9dc - S0554 Egregor — malware.
Egregor has been decrypted before execution.[NHS Digital Egregor Nov 2020][Cybereason Egregor Nov 2020]
Exact relationship: relationship--66044dfc-ab9a-4de4-a20b-cfed6d3f6236 - S0560 TEARDROP — malware.
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.[FireEye SUNBURST Backdoor December 2020][Check Point Sunburst Teardrop December 2020][Microsoft Deep Dive Solorigate January 2021]
Exact relationship: relationship--bccf4511-1e01-42ed-ab75-65d558e3fa3f - S0562 SUNSPOT — malware.
SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.[CrowdStrike SUNSPOT Implant January 2021]
Exact relationship: relationship--b8333924-1556-4c3f-b60f-105984e1f715 - S0565 Raindrop — malware.
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.[Symantec RAINDROP January 2021][Microsoft Deep Dive Solorigate January 2021]
Exact relationship: relationship--ff10b414-cc17-4335-9030-1262e5401b39 - S0567 Dtrack — malware.
Dtrack has used a decryption routine that is part of an executable physical patch.[Securelist Dtrack]
Exact relationship: relationship--ff8241d6-2a4c-41ea-b86d-43082ca0fb48 - S0574 BendyBear — malware.
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.[Unit42 BendyBear Feb 2021]
Exact relationship: relationship--045da2d4-f599-447b-931b-c11e8692fa1c - S0575 Conti — malware.
Conti has decrypted its payload using a hardcoded AES-256 key.[Cybereason Conti Jan 2021][CarbonBlack Conti July 2020]
Exact relationship: relationship--2ca546e0-6a3f-4a9f-82c3-2e41ffa67b79 - S0576 MegaCortex — malware.
MegaCortex has used a Base64 key to decode its components.[IBM MegaCortex]
Exact relationship: relationship--9a36085f-d0a9-41f2-a9cf-97e81c286ef2 - S0579 Waterbear — malware.
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.[Trend Micro Waterbear December 2019]
Exact relationship: relationship--6e73108a-836f-47ad-b88a-6b9a70ebcb7b - S0581 IronNetInjector — tool.
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.[Unit 42 IronNetInjector February 2021 ]
Exact relationship: relationship--b16b1e0e-63b0-4c5b-8809-476d9645948c - S0582 LookBack — malware.
LookBack has a function that decrypts malicious data.[Proofpoint LookBack Malware Aug 2019]
Exact relationship: relationship--fdb22ee1-d90b-496b-a7f7-baf155a1930c - S0584 AppleJeus — malware.
AppleJeus has decoded files received from a C2.[CISA AppleJeus Feb 2021]
Exact relationship: relationship--026d4fb6-4683-4e64-a69c-82e39dd11b23 - S0585 Kerrdown — malware.
Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.[Unit 42 KerrDown February 2019]
Exact relationship: relationship--cd82d148-f6b1-4247-8ccf-49fadbe7f245 - S0588 GoldMax — malware.
GoldMax has decoded and decrypted the configuration file when executed.[MSTIC NOBELIUM Mar 2021][FireEye SUNSHUTTLE Mar 2021]
Exact relationship: relationship--99e6e6cb-c19e-4689-8c92-b5429c709b91 - S0589 Sibot — malware.
Sibot can decrypt data received from a C2 and save to a file.[MSTIC NOBELIUM Mar 2021]
Exact relationship: relationship--aafa7447-cb73-4309-ac75-5326ab0d1079 - S0596 ShadowPad — malware.
ShadowPad has decrypted a binary blob to start execution.[Kaspersky ShadowPad Aug 2017]
Exact relationship: relationship--26a6be0e-6d53-4f54-b190-af359bfab4fc - S0598 P.A.S. Webshell — malware.
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.[ANSSI Sandworm January 2021]
Exact relationship: relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8 - S0601 Hildegard — malware.
Hildegard has decrypted ELF files with AES.[Unit 42 Hildegard Malware]
Exact relationship: relationship--ac5693ea-3d10-47bd-b91b-a65177dd5462 - S0603 Stuxnet — malware.
Stuxnet decrypts resources that are loaded into memory and executed.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]
Exact relationship: relationship--3921c748-c29e-4c2f-b5cb-bcc7c0237219 - S0604 Industroyer — malware.
Industroyer decrypts code to connect to a remote C2 server.[ESET Industroyer]
Exact relationship: relationship--f3d0ffd9-5bda-46fd-ba44-ef1b1def9506 - S0610 SideTwist — malware.
SideTwist can decode and decrypt messages received from C2.[Check Point APT34 April 2021]
Exact relationship: relationship--9dcec42b-174d-4b74-8aab-c5727a71c25c - S0611 Clop — malware.
Clop has used a simple XOR operation to decrypt strings.[Mcafee Clop Aug 2019]
Exact relationship: relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8 - S0612 WastedLocker — malware.
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.[NCC Group WastedLocker June 2020]
Exact relationship: relationship--c9ebddf7-337f-4002-84fd-84a7744b78e1 - S0613 PS1 — malware.
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.[BlackBerry CostaRicto November 2020]
Exact relationship: relationship--bf9adcbf-3d35-4d70-b681-e7180f3c08da - S0614 CostaBricks — malware.
CostaBricks has the ability to use bytecode to decrypt embedded payloads.[BlackBerry CostaRicto November 2020]
Exact relationship: relationship--f2d433c3-d134-4985-8dc1-b35d407b330a - S0615 SombRAT — malware.
SombRAT can run <code>upload</code> to decrypt and upload files from storage.[BlackBerry CostaRicto November 2020][CISA AR21-126A FIVEHANDS May 2021]
Exact relationship: relationship--21281614-d7cc-4211-9365-d318c99cb906 - S0618 FIVEHANDS — malware.
FIVEHANDS has the ability to decrypt its payload prior to execution.[FireEye FiveHands April 2021][CISA AR21-126A FIVEHANDS May 2021][NCC Group Fivehands June 2021]
Exact relationship: relationship--afd2f545-557a-4113-bc0a-3191e71bcbea - S0622 AppleSeed — malware.
AppleSeed can decode its payload prior to execution.[Malwarebytes Kimsuky June 2021]
Exact relationship: relationship--3a6a72e8-0637-41db-b455-6b5d629aba28 - S0623 Siloscape — malware.
Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the <code>unzip</code> binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.[Unit 42 Siloscape Jun 2021]
Exact relationship: relationship--95fc8b91-eda2-49e9-b2fb-b3cdfacc0eaa - S0624 Ecipekac — malware.
Ecipekac has the ability to decrypt fileless loader modules.[Securelist APT10 March 2021]
Exact relationship: relationship--f8e31b9d-941d-4f58-ae3a-3bdbf4b2a923 - S0628 FYAnti — malware.
FYAnti has the ability to decrypt an embedded .NET module.[Securelist APT10 March 2021]
Exact relationship: relationship--c9759e33-1cdd-472a-b3fc-f3263f218fdb - S0629 RainyDay — malware.
RainyDay can decrypt its payload via a XOR key.[Bitdefender Naikon April 2021]
Exact relationship: relationship--2e2e3a71-51b6-4779-a376-a9cc2750b5da - S0631 Chaes — malware.
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.[Cybereason Chaes Nov 2020]
Exact relationship: relationship--ebbb5d6e-9949-436b-85c5-5cd90a681042 - S0632 GrimAgent — malware.
GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.[Group IB GrimAgent July 2021]
Exact relationship: relationship--c9256d21-a464-477a-8756-96eae300b0e4 - S0634 EnvyScout — malware.
EnvyScout can deobfuscate and write malicious ISO files to disk.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--68896b85-a0ed-4b99-a776-dbdd3092ac07 - S0635 BoomBox — malware.
BoomBox can decrypt AES-encrypted files downloaded from C2.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--353dd407-0850-4bc4-a447-cd1b708b3833 - S0636 VaporRage — malware.
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--1a06ec1e-319c-4229-8ec7-b368f3886791 - S0637 NativeZone — malware.
NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.[MSTIC Nobelium Toolset May 2021]
Exact relationship: relationship--abeb8fca-e470-4119-a07f-a6ec2f4b4667 - S0638 Babuk — malware.
Babuk has the ability to unpack itself into memory using XOR.[Sogeti CERT ESEC Babuk March 2021][Medium Babuk February 2021]
Exact relationship: relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5 - S0640 Avaddon — malware.
Avaddon has decrypted encrypted strings.[Arxiv Avaddon Feb 2021]
Exact relationship: relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc - S0641 Kobalos — malware.
Kobalos decrypts strings right after the initial communication, but before the authentication process.[ESET Kobalos Jan 2021]
Exact relationship: relationship--8265aa36-4e63-4ee9-8cfe-4ed82839efce - S0642 BADFLICK — malware.
BADFLICK can decode shellcode using a custom rotating XOR cipher.[Accenture MUDCARP March 2019]
Exact relationship: relationship--d1a489c9-f937-4cc8-85d0-b4ce6b961a62 - S0647 Turian — malware.
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.[ESET BackdoorDiplomacy Jun 2021]
Exact relationship: relationship--9d293200-1425-4a77-8a2e-75a1ffb78310 - S0650 QakBot — malware.
QakBot can deobfuscate and re-assemble code strings for execution.[Cyberint Qakbot May 2021][ATT QakBot April 2021][Kaspersky QakBot September 2021]
Exact relationship: relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2 - S0653 xCaon — malware.
xCaon has decoded strings from the C2 server before executing commands.[Checkpoint IndigoZebra July 2021]
Exact relationship: relationship--f2034fc3-e721-42ce-be50-d58668c5da4b - S0660 Clambling — malware.
Clambling can deobfuscate its payload prior to execution.[Trend Micro DRBControl February 2020][Talent-Jump Clambling February 2020]
Exact relationship: relationship--ae788f2a-e2d8-4615-8714-f1263c987b23 - S0661 FoggyWeb — malware.
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.[MSTIC FoggyWeb September 2021]
Exact relationship: relationship--23679538-e90c-430d-b375-6d8bbf8ec723 - S0663 SysUpdate — malware.
SysUpdate can deobfuscate packed binaries in memory.[Trend Micro Iron Tiger April 2021]
Exact relationship: relationship--1387ec64-ba36-42cd-b659-c29e708d8281 - S0665 ThreatNeedle — malware.
ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.[Kaspersky ThreatNeedle Feb 2021]
Exact relationship: relationship--b71e10b8-e566-470b-8a5c-b634ddfd3965 - S0666 Gelsemium — malware.
Gelsemium can decompress and decrypt DLLs and shellcode.[ESET Gelsemium June 2021]
Exact relationship: relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71 - S0667 Chrommme — malware.
Chrommme can decrypt its encrypted internal code.[ESET Gelsemium June 2021]
Exact relationship: relationship--53b64a61-b521-4767-9c3a-bb73d518aa15 - S0669 KOCTOPUS — malware.
KOCTOPUS has deobfuscated itself before executing its commands.[MalwareBytes LazyScripter Feb 2021]
Exact relationship: relationship--03b52236-a63f-4ffe-88bd-15cb5ac69a66 - S0670 WarzoneRAT — malware.
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.[Check Point Warzone Feb 2020]
Exact relationship: relationship--7e941100-b4aa-43fa-a7c5-328fb211ecce - S0673 DarkWatchman — malware.
DarkWatchman has the ability to self-extract as a RAR archive.[Prevailion DarkWatchman 2021]
Exact relationship: relationship--a6bb9c7f-3e1c-429a-a81d-0d446f4abe9a - S0674 CharmPower — malware.
CharmPower can decrypt downloaded modules prior to execution.[Check Point APT35 CharmPower January 2022]
Exact relationship: relationship--45f7f495-2de8-4f78-87ec-14201cfc1d46 - S0678 Torisma — malware.
Torisma has used XOR and Base64 to decode C2 data.[McAfee Lazarus Nov 2020]
Exact relationship: relationship--512b3fed-39aa-407d-b274-5a65229688b7 - S0681 Lizar — malware.
Lizar has decrypted its configuration data, such as the C2 IP address, ports and other network communication.[BiZone Lizar May 2021][SekoiaBourhis_DiceLoader_Feb2024]
Exact relationship: relationship--9b8ff6e6-8b67-4182-9752-fa1cf15c0485 - S0687 Cyclops Blink — malware.
Cyclops Blink can decrypt and parse instructions sent from C2.[NCSC Cyclops Blink February 2022]
Exact relationship: relationship--e98ae201-7492-4aef-9b17-6499956bbe2b - S0689 WhisperGate — malware.
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.[Cisco Ukraine Wipers January 2022][Medium S2W WhisperGate January 2022]
Exact relationship: relationship--c89f4447-e8dc-4b6f-aa52-fade3ced3268 - S0690 Green Lambert — malware.
Green Lambert can use multiple custom routines to decrypt strings prior to execution.[Objective See Green Lambert for OSX Oct 2021][Glitch-Cat Green Lambert ATTCK Oct 2021]
Exact relationship: relationship--817dc3ce-3e77-4e91-a9e4-9c8c8579e722 - S0697 HermeticWiper — malware.
HermeticWiper can decompress and copy driver files using `LZCopy`.[Crowdstrike DriveSlayer February 2022]
Exact relationship: relationship--8580c1e0-84fd-4da9-a9e8-1ae17f1b67d2 - S1012 PowerLess — malware.
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.[Cybereason PowerLess February 2022]
Exact relationship: relationship--dfcd4d41-11f4-4891-9e49-7a725ab18d1d - S1013 ZxxZ — malware.
ZxxZ has used a XOR key to decrypt strings.[Cisco Talos Bitter Bangladesh May 2022]
Exact relationship: relationship--f649505a-555f-4939-980e-916a511c3134 - S1014 DanBot — malware.
DanBot can use a VBA macro to decode its payload prior to installation and execution.[SecureWorks August 2019]
Exact relationship: relationship--d0146a8e-8658-40c4-8232-bec51e1ab9a2 - S1016 MacMa — malware.
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.[ESET DazzleSpy Jan 2022]
Exact relationship: relationship--a412040d-d8ed-48b4-979c-7cbc6f9ced1c - S1018 Saint Bot — malware.
Saint Bot can deobfuscate strings and files for execution.[Malwarebytes Saint Bot April 2021]
Exact relationship: relationship--b105573a-4d07-4253-8a5b-82f68357e098 - S1019 Shark — malware.
Shark can extract and decrypt downloaded .zip files.[ClearSky Siamesekitten August 2021]
Exact relationship: relationship--b10f18a6-43a8-436f-8d9c-f180428f0a0d - S1022 IceApple — malware.
IceApple can use a Base64-encoded AES key to decrypt tasking.[CrowdStrike IceApple May 2022]
Exact relationship: relationship--753b0a84-4455-4706-babf-f9bf75e530be - S1025 Amadey — malware.
Amadey has decoded antivirus name strings.[Korean FSI TA505 2020]
Exact relationship: relationship--d850589b-a36f-446e-9864-ae4d4a62b724 - S1026 Mongall — malware.
Mongall has the ability to decrypt its payload prior to execution.[SentinelOne Aoqin Dragon June 2022]
Exact relationship: relationship--2310e7b8-a4c7-460d-a89d-8d5854c59a44 - S1027 Heyoka Backdoor — malware.
Heyoka Backdoor can decrypt its payload prior to execution.[SentinelOne Aoqin Dragon June 2022]
Exact relationship: relationship--52893247-a6d6-4119-881a-09e10121edf5 - S1028 Action RAT — malware.
Action RAT can use Base64 to decode actor-controlled C2 server communications.[MalwareBytes SideCopy Dec 2021]
Exact relationship: relationship--0303acd0-64a4-4e40-b8e3-29e1c43694d2 - S1030 Squirrelwaffle — malware.
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.[ZScaler Squirrelwaffle Sep 2021][Netskope Squirrelwaffle Oct 2021]
Exact relationship: relationship--39e0a84e-24de-4b0f-a0e4-3a821b8f963a - S1031 PingPull — malware.
PingPull can decrypt received data from its C2 server by using AES.[Unit 42 PingPull Jun 2022]
Exact relationship: relationship--d0a02e9b-9247-4bce-9070-649d7c908640 - S1032 PyDCrypt — malware.
PyDCrypt has decrypted and dropped the DCSrv payload to disk.[Checkpoint MosesStaff Nov 2021]
Exact relationship: relationship--4e3a250d-c168-4544-82c5-3b1414be826d - S1039 Bumblebee — malware.
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.[Proofpoint Bumblebee April 2022][Medium Ali Salem Bumblebee April 2022]
Exact relationship: relationship--3471a32a-47fc-4ba7-ac67-887d9872e316 - S1041 Chinoxy — malware.
The Chinoxy dropping function can initiate decryption of its config file.[Bitdefender FunnyDream Campaign November 2020]
Exact relationship: relationship--356aa4b0-e6c2-4ef7-a3b2-837c25c283b3 - S1046 PowGoop — malware.
PowGoop can decrypt PowerShell scripts for execution.[DHS CISA AA22-055A MuddyWater February 2022][CYBERCOM Iranian Intel Cyber January 2022]
Exact relationship: relationship--c935af5a-b6e3-41b8-afa8-f9d7ad593201 - S1047 Mori — malware.
Mori can resolve networking APIs from strings that are ADD-encrypted.[DHS CISA AA22-055A MuddyWater February 2022]
Exact relationship: relationship--7d37a0f1-1aea-456c-ade6-6d463a14fc14 - S1050 PcShare — tool.
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.[Bitdefender FunnyDream Campaign November 2020]
Exact relationship: relationship--8a36b1bf-52a8-4e93-bac2-e28c60b7d64d - S1051 KEYPLUG — malware.
KEYPLUG can decode its configuration file to determine C2 protocols.[Mandiant APT41]
Exact relationship: relationship--43c68bb8-28e2-4ee0-91aa-ffc16dcc45bc - S1052 DEADEYE — malware.
DEADEYE has the ability to combine multiple sections of a binary which were broken up to evade detection into a single .dll prior to execution.[Mandiant APT41]
Exact relationship: relationship--a4cc226c-2858-4040-a90d-5cf1297fd78c - S1053 AvosLocker — malware.
AvosLocker has deobfuscated XOR-encoded strings.[Malwarebytes AvosLocker Jul 2021]
Exact relationship: relationship--748cd538-d2a0-470c-b6fb-68e73b8069b1 - S1059 metaMain — malware.
metaMain can decrypt and load other modules.[SentinelLabs Metador Sept 2022]
Exact relationship: relationship--5998186f-20af-4b30-8ae7-4d4648d96327 - S1060 Mafalda — malware.
Mafalda can decrypt files and data.[SentinelLabs Metador Sept 2022]
Exact relationship: relationship--4975b6f9-c542-4ad9-bfeb-6182c4db895f - S1063 Brute Ratel C4 — tool.
Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.[Palo Alto Brute Ratel July 2022]
Exact relationship: relationship--7ee1407c-ee33-47bc-824a-6f0dcd385462 - S1065 Woody RAT — malware.
Woody RAT can deobfuscate Base64-encoded strings and scripts.[MalwareBytes WoodyRAT Aug 2022]
Exact relationship: relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6 - S1066 DarkTortilla — malware.
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.[Secureworks DarkTortilla Aug 2022]
Exact relationship: relationship--0977c267-10f9-4e4d-a947-464359c7a4ba - S1076 QUIETCANARY — malware.
QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.[Mandiant Suspected Turla Campaign February 2023]
Exact relationship: relationship--27d0ccf1-00df-40f5-ad96-807e54862467 - S1078 RotaJakiro — malware.
RotaJakiro uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt resources required for persistence, process guarding, and file locking. It also performs this same function on encrypted stack strings and the `head` and `key` sections in the network packet structure used for C2 communications.[RotaJakiro 2021 netlab360 analysis]
Exact relationship: relationship--0924ca96-c26b-4bd1-8c50-d3c1a9e1e25b - S1085 Sardonic — malware.
Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.[Symantec FIN8 Jul 2023]
Exact relationship: relationship--582215ef-b7dd-43c3-a4ca-3a4a14edde59 - S1086 Snip3 — malware.
Snip3 can decode its second-stage PowerShell script prior to execution.[Morphisec Snip3 May 2021]
Exact relationship: relationship--03e6a535-5c95-47e7-a369-aed653022c7c - S1097 HUI Loader — malware.
HUI Loader can decrypt and load files containing malicious payloads.[SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022]
Exact relationship: relationship--950d2e53-296a-491e-aadf-8cc5d04df41b - S1100 Ninja — malware.
The Ninja loader component can decrypt and decompress the payload.[Kaspersky ToddyCat June 2022][Kaspersky ToddyCat Check Logs October 2023]
Exact relationship: relationship--78160020-3c63-4e60-81f4-f6438bfbd6a4 - S1105 COATHANGER — malware.
COATHANGER decodes configuration items from a bundled file for command and control activity.[NCSC-NL COATHANGER Feb 2024]
Exact relationship: relationship--ccb19fb9-7c27-4941-b383-62386a4a6429 - S1110 SLIGHTPULSE — malware.
SLIGHTPULSE can deobfuscate base64 encoded and RC4 encrypted C2 messages.[Mandiant Pulse Secure Zero-Day April 2021]
Exact relationship: relationship--627ec847-1807-4e99-b968-f1ab412d17d1 - S1111 DarkGate — malware.
DarkGate installation includes binary code stored in a file located in a hidden directory, such as <code>shell.txt</code>, that is decrypted then executed.[Ensilo Darkgate 2018] DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API <code>CallWindowProc()</code> to decode and then execute.[Trellix Darkgate 2023]
Exact relationship: relationship--a7f61ae3-bbeb-40c8-86c9-bed3cf1e1953 - S1112 STEADYPULSE — malware.
STEADYPULSE can URL decode key/value pairs sent over C2.[Mandiant Pulse Secure Zero-Day April 2021]
Exact relationship: relationship--d86a36a9-fce9-4147-b375-292d6b617769 - S1113 RAPIDPULSE — malware.
RAPIDPULSE listens for specific HTTP query parameters in received communications. If specific parameters match, a hard-coded RC4 key is used to decrypt the HTTP query paremter <code>hmacTime</code>. This decrypts to a filename that is then open, read, encrypted with the same RC4 key, base64-encoded, written to standard out, then passed as a response to the HTTP request.[Mandiant Pulse Secure Update May 2021]
Exact relationship: relationship--254dea59-0bd6-4966-9eff-d5997a7e91c1 - S1115 WIREFIRE — malware.
WIREFIRE can decode, decrypt, and decompress data received in C2 HTTP `POST` requests.[Mandiant Cutting Edge January 2024]
Exact relationship: relationship--2329e6c4-5462-4d14-9a50-2d9272f83a09 - S1117 GLASSTOKEN — malware.
GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.[Volexity Ivanti Zero-Day Exploitation January 2024]
Exact relationship: relationship--55fc98ea-8269-4ac7-9209-9013de03c955 - S1118 BUSHWALK — malware.
BUSHWALK can Base64 decode and RC4 decrypt malicious payloads sent through a web request’s command parameter.[Mandiant Cutting Edge Part 2 January 2024][Mandiant Cutting Edge Part 3 February 2024]
Exact relationship: relationship--f2938ba0-1768-48a8-a36d-9d1578c6f5b1 - S1119 LIGHTWIRE — malware.
LIGHTWIRE can RC4 decrypt and Base64 decode C2 commands.[Mandiant Cutting Edge Part 2 January 2024]
Exact relationship: relationship--44caec3d-e8d3-48b6-9991-f5b164370538 - S1120 FRAMESTING — malware.
FRAMESTING can decompress data received within `POST` requests.[Mandiant Cutting Edge Part 2 January 2024]
Exact relationship: relationship--eacb139c-69ea-44a5-b299-6a2db03e4079 - S1122 Mispadu — malware.
Mispadu decrypts its encrypted configuration files prior to execution.[SCILabs Malteiro 2021][ESET Security Mispadu Facebook Ads 2019]
Exact relationship: relationship--0da38f11-0e39-4505-aa05-61464113ba8f - S1123 PITSTOP — malware.
PITSTOP can deobfuscate base64 encoded and AES encrypted commands.[Mandiant Cutting Edge Part 3 February 2024]
Exact relationship: relationship--e7caa3b3-78d3-4840-bee3-70d7637f5508 - S1130 Raspberry Robin — malware.
Raspberry Robin contains several layers of obfuscation to hide malicious code from detection and analysis.[TrendMicro RaspberryRobin 2022]
Exact relationship: relationship--c9a2ee9a-4787-47c0-9cdc-f52735f066ad - S1133 Apostle — malware.
Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.[SentinelOne Agrius 2021]
Exact relationship: relationship--f7a7e19a-7d6b-43ca-91a4-4aab1dbfeecc - S1134 DEADWOOD — malware.
DEADWOOD XORs some strings within the binary using the value <code>0xD5</code>, and deobfuscates these items at runtime.[SentinelOne Agrius 2021]
Exact relationship: relationship--a91a486b-4119-44e1-9fcf-c746849947e8 - S1138 Gootloader — malware.
Gootloader has the ability to decode and decrypt malicious payloads prior to execution.[Sophos Gootloader][SentinelOne Gootloader June 2021]
Exact relationship: relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a - S1139 INC Ransomware — malware.
INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.[Cybereason INC Ransomware November 2023]
Exact relationship: relationship--821c06ba-1cdc-40a7-bd4a-97e996bb973e - S1140 Spica — malware.
Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.[Google TAG COLDRIVER January 2024]
Exact relationship: relationship--e7c81430-1c3a-4ee8-9f10-4a3fcad2da54 - S1141 LunarWeb — malware.
LunarWeb can decrypt strings related to communication configuration using RC4 with a static key.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--613c0bcd-d165-472b-adc8-1e547edb13af - S1142 LunarMail — malware.
LunarMail can decrypt strings to retrieve configuration settings.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--38d896b7-6e7a-44e0-9b52-77da42dd59f6 - S1143 LunarLoader — malware.
LunarLoader can deobfuscate files containing the next stages in the infection chain.[ESET Turla Lunar toolset May 2024]
Exact relationship: relationship--7ae8b9cf-2524-4861-8246-394a96339f49 - S1145 Pikabot — malware.
Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm.[Zscaler Pikabot 2023] Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload <code>.text</code> section before consolidating them for further execution.[Elastic Pikabot 2024] Overall LunarMail is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.[Logpoint Pikabot 2024]
Exact relationship: relationship--bf46855b-a15e-4789-a8e6-d5ad3261ded3 - S1147 Nightdoor — malware.
Nightdoor stores network configuration data in a file XOR encoded with the key value of `0x7A`.[Symantec Daggerfly 2024]
Exact relationship: relationship--fbf9654c-45f2-41bc-83ec-3dfdfa6d5115 - S1148 Raccoon Stealer — malware.
Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.[S2W Racoon 2022][Sekoia Raccoon1 2022]
Exact relationship: relationship--de6e7fde-7407-4caf-acd0-cfa3aa458d04 - S1149 CHIMNEYSWEEP — malware.
CHIMNEYSWEEP can use an embedded RC4 key to decrypt Windows API function strings.[Mandiant ROADSWEEP August 2022]
Exact relationship: relationship--5e53c0fb-e7f9-4b6d-a0a0-b7c64b5a3b6e - S1150 ROADSWEEP — malware.
ROADSWEEP can decrypt embedded scripts prior to execution.[Mandiant ROADSWEEP August 2022][CISA Iran Albanian Attacks September 2022]
Exact relationship: relationship--708ac02f-8419-43bd-a6d6-682e28faa507 - S1153 Cuckoo Stealer — malware.
Cuckoo Stealer strings are deobfuscated prior to execution.[Kandji Cuckoo April 2024][SentinelOne Cuckoo Stealer May 2024]
Exact relationship: relationship--64eeba9b-c972-4671-bb08-fca6d2445b8a - S1158 DUSTPAN — malware.
DUSTPAN decodes and decrypts embedded payloads.[Google Cloud APT41 2024]
Exact relationship: relationship--92bab2d2-bb5a-4102-a9ec-7630153cac50 - S1159 DUSTTRAP — malware.
DUSTTRAP deobfuscates embedded payloads.[Google Cloud APT41 2024]
Exact relationship: relationship--68501e6a-dba6-4a77-a711-99ca6918a2dd - S1160 Latrodectus — malware.
Latrodectus has the ability to deobfuscate encrypted strings.[Latrodectus APR 2024][Elastic Latrodectus May 2024][Bitsight Latrodectus June 2024]
Exact relationship: relationship--5a56f203-5537-4dd1-a08d-db4526bf75bd - S1164 UPSTYLE — malware.
UPSTYLE encodes its main content prior to loading via Python as base64-encoded blobs.[Volexity UPSTYLE 2024][Palo Alto MidnightEclipse APR 2024]
Exact relationship: relationship--1bd6e148-29c0-473e-8752-66bd01e3a629 - S1168 SampleCheck5000 — malware.
SampleCheck5000 can decode and decrypt command line strings and files received through C2.[ESET OilRig Campaigns Sep 2023][ESET OilRig Downloaders DEC 2023]
Exact relationship: relationship--60061356-7b82-4bd0-b9bc-ae1518753f3a - S1170 ODAgent — malware.
ODAgent can Base64-decode and XOR decrypt received C2 commands.[ESET OilRig Downloaders DEC 2023]
Exact relationship: relationship--f5435422-0bf4-4ca2-af11-12fe12d13f8e - S1172 OilBooster — malware.
OilBooster can Base64-decode and XOR-decrypt C2 commands taken from JSON files.[ESET OilRig Downloaders DEC 2023]
Exact relationship: relationship--f59927fc-7a14-44bf-9164-47ac08cf86a4 - S1173 PowerExchange — malware.
PowerExchange can decode and decrypt C2 commands received via email.[Symantec Crambus OCT 2023]
Exact relationship: relationship--c66a8b99-9928-4b4c-83e8-e416de4d07b3 - S1179 Exbyte — malware.
Exbyte decodes and decrypts data stored in the configuration file with a key provided on the command line during execution.[Microsoft BlackByte 2023]
Exact relationship: relationship--59b93237-62e9-42bf-a3a4-8dc2148464f2 - S1180 BlackByte Ransomware — malware.
BlackByte Ransomware is distributed as an obfuscated JavaScript launcher file.[Trustwave BlackByte 2021]
Exact relationship: relationship--d3937396-a1e5-46c7-87a8-f9653895714f - S1182 MagicRAT — malware.
MagicRAT stores command and control URLs using base64 encoding in the malware's configuration file.[Cisco MagicRAT 2022]
Exact relationship: relationship--bf984c42-b059-4e2e-af65-d316569bd426 - S1183 StrelaStealer — malware.
StrelaStealer payloads have included strings encrypted via XOR.[DCSO StrelaStealer 2022] StrelaStealer JavaScript payloads utilize Base64-encoded payloads that are decoded via certutil to create a malicious DLL file.[PaloAlto StrelaStealer 2024][Fortgale StrelaStealer 2023]
Exact relationship: relationship--c948844f-25f3-4fbd-b949-f6c61a459aeb - S1186 Line Dancer — malware.
Line Dancer shellcode payloads are base64 encoded when transmitted to compromised devices.[CCCS ArcaneDoor 2024]
Exact relationship: relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1 - S1190 Kapeka — malware.
Kapeka utilizes obfuscated JSON structures for various data storage and configuration management items.[WithSecure Kapeka 2024]
Exact relationship: relationship--aff5ce36-4e3e-475e-b039-3424d5296521 - S1199 LockBit 2.0 — malware.
LockBit 2.0 can decode scripts and strings in loaded modules.[FBI Lockbit 2.0 FEB 2022][Palo Alto Lockbit 2.0 JUN 2022]
Exact relationship: relationship--74efbb05-7272-4cf4-9fa7-5720e8bfe26d - S1200 StealBit — malware.
StealBit can deobfuscate loaded modules prior to execution.[FBI Lockbit 2.0 FEB 2022][Cybereason StealBit Exfiltration Tool]
Exact relationship: relationship--f3dcd0dd-8657-47b4-b523-38e68bc0ee0f - S1202 LockBit 3.0 — malware.
The LockBit 3.0 payload is decrypted at runtime.[Sentinel Labs LockBit 3.0 JUL 2022][Joint Cybersecurity Advisory LockBit 3.0 MAR 2023][INCIBE-CERT LockBit MAR 2024]
Exact relationship: relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635 - S1207 XLoader — malware.
XLoader uses XOR and RC4 algorithms to decrypt payloads and functions.[Zscaler XLoader 2025] XLoader can be distributed as a self-extracting RAR archive that launches an AutoIT loader.[Google XLoader 2017]
Exact relationship: relationship--b4f15c4f-eedd-4045-bdec-57393716fa50 - S1210 Sagerunex — malware.
Sagerunex uses a custom decryption routine to unpack itself during installation.[Cisco LotusBlossom 2025]
Exact relationship: relationship--7aab5534-4c3b-4812-a612-eccee79396f6 - S1212 RansomHub — malware.
RansomHub can use a provided passphrase to decrypt its configuration file.[Group-IB RansomHub FEB 2025]
Exact relationship: relationship--677e51a3-11ba-4685-8374-f5a21677f37d - S1213 Lumma Stealer — malware.
Lumma Stealer has used Base64-encoded content during execution, decoded via PowerShell.[Netskope LummaStealer 2025]
Exact relationship: relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413 - S1219 REPTILE — malware.
The REPTILE launcher component can decrypt kernel module code from a file and load it into memory.[Google Cloud Mandiant UNC3886 2024]
Exact relationship: relationship--8cd609cc-a203-424e-bcea-264dd83f4d5a - S1221 MOPSLED — malware.
MOPSLED can decrypt obfuscated configuration files.[Google Cloud Mandiant UNC3886 2024]
Exact relationship: relationship--6b66277b-be7b-484b-86f4-fd97c7a4d4b7 - S1222 RIFLESPINE — malware.
RIFLESPINE can deobfuscate encrypted files prior to execution on targeted hosts.[Google Cloud Mandiant UNC3886 2024]
Exact relationship: relationship--69563781-6287-402d-926d-c671005ee240 - S1223 THINCRUST — malware.
THINCRUST can deobfuscate RSA encrypted C2 commands received through the DEVICEID cookie.[Mandiant Fortinet Zero Day]
Exact relationship: relationship--a2644706-c75e-47b9-8167-f9db9481262e - S1224 CASTLETAP — malware.
CASTLETAP can filter and deobfuscate an XOR encrypted activation string in the payload of an ICMP echo request.[Mandiant Fortinet Zero Day]
Exact relationship: relationship--340825b1-a2db-4be1-943a-9b529842ae18 - S1226 BOOKWORM — malware.
BOOKWORM has decoded its Base64 encoded payload prior to execution.[Palo Alto Networks, Unit 42] BOOKWORM has also encrypted files with RC4 and has decrypted its payload prior to execution.[Unit42 Bookworm Nov2015]
Exact relationship: relationship--7bfbdba0-2f18-4697-bf86-294bda685df5 - S1227 StarProxy — malware.
StarProxy has decrypted network packets using a custom algorithm.[Zscaler]
Exact relationship: relationship--fc61d659-2c80-4148-92ff-b689093a49b2 - S1228 PUBLOAD — malware.
PUBLOAD has decoded its payload prior to execution.[Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022][Lab52 MUSTANG PANDA PUBLOAD MAY 2023][2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA][2022 November_TrendMicro_Earth Preta_Toneshell_Pubload][Palo Alto Networks, Unit 42]
Exact relationship: relationship--5bb98e61-548f-4ba0-9a25-50cbca531826 - S1232 SplatDropper — malware.
SplatDropper has decoded XOR encrypted payload.[Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025]
Exact relationship: relationship--ab5fd28f-c304-46a2-a07d-c037dc67ba2c - S1235 CorKLOG — malware.
CorKLOG has decoded XOR encrypted strings.[Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025]
Exact relationship: relationship--5149c8de-5790-4f52-8527-1e2aac11b381 - S1236 CLAIMLOADER — malware.
CLAIMLOADER has decoded its payload prior to execution.[IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025][2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA]
Exact relationship: relationship--e9a7ebd2-e8ec-4047-84d2-831018de10ab - S1239 TONESHELL — malware.
TONESHELL has decoded its payload prior to execution.[2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA][Trend Micro Mustang Panda Earth Preta Toneshell February 2025][2022 November_TrendMicro_Earth Preta_Toneshell_Pubload][Zscaler][Unit42 Chinese VSCode 06 September 2024]
Exact relationship: relationship--8a3a6312-e5fc-44bd-858c-886d0aa8b7c7 - S1240 RedLine Stealer — malware.
RedLine Stealer has decoded its payload prior to execution.[Splunk RedLine Stealer June 2023]
Exact relationship: relationship--a1e3d08f-cec9-48df-b377-6f0d0d223e3b - S1244 Medusa Ransomware — malware.
Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.[Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024][Security Scorecard Medusa Ransomware January 2024]
Exact relationship: relationship--799e9c4b-2f06-4917-8f91-aa1c7773f56b - S1245 InvisibleFerret — malware.
InvisibleFerret has decoded XOR-encrypted and Base-64-encoded payloads prior to execution.[ESET Contagious Interview BeaverTail InvisibleFerret February 2025]
Exact relationship: relationship--3e0509c4-02e0-4f07-9b8c-7c51687494cf - S1247 Embargo — malware.
Embargo has utilized MDeployer to decrypt two payloads that contain MS4Killer toolkit b.cache and the Embargo ransomware executable a.cache with a hardcoded RC4 key `wlQYLoPCil3niI7x8CvR9EtNtL/aeaHrZ23LP3fAsJogVTIzdnZ5Pi09ZVeHFkiB`.[ESET Embargo Ransomware October 2024]
Exact relationship: relationship--7d4609c1-6f92-44e4-8580-158bb2c91426 - S1248 XORIndex Loader — malware.
XORIndex Loader can decode its payload prior to execution.[Socket BeaverTail XORIndex HexEval Contagious Interview July 2025]
Exact relationship: relationship--21b4dd86-a629-4e42-944c-f5e4b90e5312 - S1249 HexEval Loader — malware.
HexEval Loader has decoded its payload prior to execution.[Socket Contagious Interview NPM April 2025][Socket BeaverTail XORIndex HexEval Contagious Interview July 2025][Socket HexEval BeaverTail Contagious Interview June 2025]
Exact relationship: relationship--c0b37fb2-6a19-40cf-bb18-a7289e235398 - S9001 SystemBC — malware.
SystemBC has the ability to decrypt RC4 encrypted packets and to decode obfuscated data before C2 communication.[AhnLab_SystemBC_Apr2022] Additionally, SystemBC has decrypted its config file that was encoded with XOR and a hardcoded 40-byte key.[Lumen_SystemBC_Sept2025]
Exact relationship: relationship--441fa206-c1cf-40dd-850e-897adcf4776f - S9007 HTTPTroy — malware.
HTTPTroy has decoded strings encoded with Base64 and XOR prior to execution.[Gen Digital Kimsuky HTTPTroy October 2025]
Exact relationship: relationship--acedb80d-7646-4c2f-a4e2-3623410823e9 - S9010 GlassWorm — malware.
GlassWorm has decoded its Base64 instructions.[Koi Glassworm InvisibleCode October 2025] GlassWorm has also decrypted its AES protected payloads.[Koi Glassworm New Tricks December 2025][Koi Glassworm InvisibleCode October 2025][Socket GlassWorm January 2026]
Exact relationship: relationship--397cb08d-0466-4f92-8317-73da637dcded - S9011 BRUSHFIRE — malware.
BRUSHFIRE has decrypted XOR strings prior to execution.[Google UNC5221 Ivanti April 2025]
Exact relationship: relationship--3cadf7f7-481c-45e4-b64b-ed03b349be20 - S9014 PHASEJAM — malware.
PHASEJAM has the ability to decode Base64 commands and data.[Google UNC5221 Ivanti January 2025]
Exact relationship: relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53 - S9015 BRICKSTORM — malware.
BRICKSTORM has decoded its encrypted C2 traffic prior to execution.[CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025][CISA BRICKSTORM UNC5221 AR25-338A February 2026][Picus Security BRICKSTORM UNC5221 October 2025][Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025][Google BRICKSTORM September 2025] BRICKSTORM also has the ability to decode its obfuscated payload before execution.[Picus Security BRICKSTORM UNC5221 October 2025]
Exact relationship: relationship--7b292c68-de29-4db0-8f07-67028da4a595 - S9016 Caminho — malware.
Caminho can deobfuscate downloaded files prior to execution.[Zscaler BlindEagle DEC 2025]
Exact relationship: relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616 - S9018 HeartCrypt — malware.
HeartCrypt can decrypt payloads prior to execution.[Palo Alto HeartCrypt DEC 2024][Check Point Blind Eagle MAR 2025]
Exact relationship: relationship--609f941d-2768-4e1f-9286-774a954a8bdb - S9019 PureCrypter — malware.
PureCrypter can decrypt downloaded resources and parse internal files to determine its settings.[Zscaler PureCrypter JUN 2022][Check Point Blind Eagle MAR 2025]
Exact relationship: relationship--68166b59-ac4b-4bdc-928d-01e945611a5e - S9021 DOWNIISSA — malware.
DOWNIISSA can decode strings prior to execution.[Kaspersky LODEINFO OCT 2022]
Exact relationship: relationship--66c646e5-2364-4d26-bd03-56e5544553d3 - S9023 HiddenFace — malware.
HiddenFace has the ability to decrypt its payload prior to execution.[ESET HiddenFace 2024][JPCERT MirrorFace JUL 2024]
Exact relationship: relationship--e74df3d8-4609-4f07-bdb0-b0531b79038c - S9024 SPAWNCHIMERA — malware.
SPAWNCHIMERA has decoded a XOR encoded private key.[JPCERT SPAWNCHIMERA Ivanti February 2025]
Exact relationship: relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0 - S9025 NOOPLDR — malware.
NOOPLDR can decrypt its payload prior to execution.[Trend Micro Earth Kasha NOV 2024]
Exact relationship: relationship--39adf593-14d2-42c7-a9e3-957ada5ec5b1 - S9026 ROAMINGHOUSE — malware.
ROAMINGHOUSE can decode and drop a malicious ZIP file prior to execution.[Trend Micro Earth Kasha Updates APR 2025]
Exact relationship: relationship--0bdfdf48-6d8b-4eeb-968d-fb3a73889d17 - S9027 ANELLDR — malware.
ANELLDR can decrypt encrypted payload data using AES-256-CBC and subsequently execute the payload in memory.[Trend Micro Earth Kasha Anel NOV 2024]
Exact relationship: relationship--3f55cf61-8cbe-48ac-904f-299030d02dc3 - S9028 PHPsert — malware.
PHPsert has the ability to decode and decrypt obfuscated strings prior to execution.[sentinelone operationDigitalEye Dec 2024]
Exact relationship: relationship--0133e2fc-5673-40a5-982b-9b0f441217f5 - S9029 IronWind — malware.
IronWind can deobfuscate the next stage payload using Base64 and XOR operations with the key "53".[Check Point Wirte NOV 2024]
Exact relationship: relationship--ad472921-19b8-43ac-9b22-1ebb4f353b66 - S9031 AshTag — malware.
The AshTag stager compoment can decode and decrypt Base64 and XOR-encrypted payloads.[Palo Alto Ashen Lepus DEC 2025]
Exact relationship: relationship--7b695677-86d7-4de6-bce7-970ac2207d77 - S9032 MuddyViper — malware.
MuddyViper has decrypted the embedded HackBrowserData tool prior to execution.[ESET_MuddyWater_Dec2025]
Exact relationship: relationship--a8bf6c5d-6201-4d5e-883f-4818d721e247 - S9033 Fooder — malware.
Fooder has decrypted payloads using the WinCrypt API and the AES key.[ESET_MuddyWater_Dec2025]
Exact relationship: relationship--e7c9e0f2-d1be-440b-9b6b-7273661d8dac - S9034 Tsundere Botnet — malware.
Tsundere Botnet’s loader has decrypted obfuscated JavaScript files using the AES-256 CBC algorithm, a build-specific key, and initialization vector.[SecureListUbiedo_Tsundere_Nov2025][CAL_MuddyWater_Mar2026]
Exact relationship: relationship--da225cfe-1959-4faa-afef-b5c7a6555bba - S9035 LAMEHUG — malware.
LAMEHUG can decode and drop a decoy file attached to spearphishing emails.[Splunk LAMEHUG SEP 2025]
Exact relationship: relationship--7cf769d6-3d2d-44a8-a8d0-dbf1da1f98d4 - S9036 LP-Notes — malware.
LP-Notes has decrypted strings with lengths ranging from 15 to 19 characters using the same decryption key for each string.[ESET_MuddyWater_Dec2025]
Exact relationship: relationship--3c7d55d0-6f53-4e2f-8504-9a298d275286 - S9037 RustyWater — malware.
RustyWater has used the WriteHexToFile function to transform an embedded hex string to the payload CertificationKit.ini.[CloudSEK_RustyWater_Jan2026]
Exact relationship: relationship--c2e3c3ad-669a-4c20-8fd8-04626433a03c - S9041 TeamPCP Cloud Stealer — malware.
TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.[Aqua Security Blog Trivy Compromise APR 2026]
Exact relationship: relationship--57388233-1b28-4ae4-b92b-f5eb7d47d6f0 - S9042 CanisterWorm — malware.
CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.[Aikido TeamPCP Trivy MAR 2026]
Exact relationship: relationship--57861b9c-0d72-4c5d-8240-5fd038acf454 - S9043 Mini Shai-Hulud — malware.
Mini Shai-Hulud has the ability to decrypt obfuscated payloads.[Trend Micro TeamPCP MAY 2026]
Exact relationship: relationship--887d8582-e9a4-4058-a917-4dea8dc3ab8c - S9046 IOControl — malware.
IOCONTROL has used the AES-256-CBC algorithm to decrypt configuration files associated with the malware.[Claroty-IOCONTROL] [Dragos-2026-Year-In-Review]
Exact relationship: relationship--114934d2-1f35-461f-9a18-1ae434695b30 - S9050 Vidar — malware.
Vidar has used the function `CryptDecrypt`. Additionally, Vidar has decoded the .data section using bitwise XOR operations.[Cyfirma_Vidar_June2024] Vidar has decoded its core code after confirming debugger and/or analysis tools.[Cyfirma_Vidar_June2024]
Exact relationship: relationship--9021cef7-4b93-443c-a166-20a659fb6b56 - S9052 MiniFast — malware.
MiniFast has decoded Base64-encoded tasks from the C2.[CheckPoint_NimbusManticore_May2026]
Exact relationship: relationship--657ef43d-5d67-4699-8308-0ec83ff16485 - S9057 CRASHPAD — malware.
CRASHPAD has decrypted the config file ` C:\Program Files\VMware\VMware Tools\VMware VGAuth\config.txt ` to move the contents to a newly created file called ` C:\Program Files\VMware\VMware Tools\VMware VGAuth\crash.log `.[Mandiant_UNC1549_Nov2025]
Exact relationship: relationship--1bb8999a-16c3-420d-8feb-65b104d18fd9 - S9058 SIGHTGRAB — malware.
SIGHTGRAB has decrypted XOR-encrypted strings.[Mandiant_UNC1549_Nov2025]
Exact relationship: relationship--ff66d5ca-9ce1-49bb-871a-8e5579c5bc3e