T1027: Obfuscated Files or Information

Description

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript.

Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016)

Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Platforms

Sub-Techniques (18)

Mitigations (4)

Threat Groups (18)

ID	Group	Context
G0093	GALLIUM	[GALLIUM](https://attack.mitre.org/groups/G0093) used a modified version of [HTRAN](https://attack.mitre.org/software/S0040) in which they obfuscated ...
G0022	APT3	[APT3](https://attack.mitre.org/groups/G0022) obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has obfuscated binary strings including the use of XOR encryption and Base64 encoding.(Citation: Thre...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered self-extracting 7z archive files within malicious document attachments.(Citatio...
G0084	Gallmaker	[Gallmaker](https://attack.mitre.org/groups/G0084) obfuscated shellcode used during execution.(Citation: Symantec Gallmaker Oct 2018)
G0034	Sandworm Team	[Sandworm Team](https://attack.mitre.org/groups/G0034) has used Base64 encoding within malware variants.(Citation: iSight Sandworm Oct 2014)
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) has delivered initial payloads hidden using archives and encoding measures.(Citation: Anomali M...
G0106	Rocke	[Rocke](https://attack.mitre.org/groups/G0106) has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)
G0067	APT37	[APT37](https://attack.mitre.org/groups/G0067) obfuscates strings and payloads.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)(Cit...
G0004	Ke3chang	[Ke3chang](https://attack.mitre.org/groups/G0004) has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)
G1039	RedCurl	[RedCurl](https://attack.mitre.org/groups/G1039) has used malware with string encryption.(Citation: therecord_redcurl) [RedCurl](https://attack.mitre....
G0135	BackdoorDiplomacy	[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy J...
G0112	Windshift	[Windshift](https://attack.mitre.org/groups/G0112) has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)
G0099	APT-C-36	[APT-C-36](https://attack.mitre.org/groups/G0099) has used ConfuserEx to obfuscate its variant of [Imminent Monitor](https://attack.mitre.org/software...
G1006	Earth Lusca	[Earth Lusca](https://attack.mitre.org/groups/G1006) used Base64 to encode strings.(Citation: TrendMicro EarthLusca 2022)
G0063	BlackOasis	[BlackOasis](https://attack.mitre.org/groups/G0063)'s first stage shellcode contains a NOP sled with alternative instructions that was likely designed...
G1036	Moonstone Sleet	[Moonstone Sleet](https://attack.mitre.org/groups/G1036) delivers encrypted payloads in pieces that are then combined together to form a new portable ...

Associated Software (138)

ID	Name	Type	Context
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) uses non-descriptive names to hide functionality.(Citation: S2 Grupo TrickBot June 2017)
S0605	EKANS	Malware	[EKANS](https://attack.mitre.org/software/S0605) uses encoded strings in its process kill list.(Citation: FireEye Ransomware Feb 2020)
S0242	SynAck	Malware	[SynAck](https://attack.mitre.org/software/S0242) payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.(Citatio...
S1039	Bumblebee	Malware	[Bumblebee](https://attack.mitre.org/software/S1039) has been delivered as password-protected zipped ISO files and used control-flow-flattening to obf...
S9015	BRICKSTORM	Malware	[BRICKSTORM](https://attack.mitre.org/software/S9015) has utilized Go libraries to include Garble to obfuscate code.(Citation: Picus Security BRICKSTO...
S1025	Amadey	Malware	[Amadey](https://attack.mitre.org/software/S1025) has obfuscated strings such as antivirus vendor names, domains, files, and others.(Citation: BlackBe...
S0229	Orz	Malware	Some [Orz](https://attack.mitre.org/software/S0229) strings are base64 encoded, such as the embedded DLL known as MockDll.(Citation: Proofpoint Leviat...
S0353	NOKKI	Malware	[NOKKI](https://attack.mitre.org/software/S0353) uses Base64 encoding for strings.(Citation: Unit 42 NOKKI Sept 2018)
S1053	AvosLocker	Malware	[AvosLocker](https://attack.mitre.org/software/S1053) has used XOR-encoded strings.(Citation: Malwarebytes AvosLocker Jul 2021)
S1105	COATHANGER	Malware	[COATHANGER](https://attack.mitre.org/software/S1105) can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/p...
S1085	Sardonic	Malware	[Sardonic](https://attack.mitre.org/software/S1085) can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.(Citatio...
S0167	Matryoshka	Malware	[Matryoshka](https://attack.mitre.org/software/S0167) obfuscates API function names using a substitute cipher combined with Base64 encoding.(Citation:...
S0624	Ecipekac	Malware	[Ecipekac](https://attack.mitre.org/software/S0624) can use XOR, AES, and DES to encrypt loader shellcode.(Citation: Securelist APT10 March 2021)
S0622	AppleSeed	Malware	[AppleSeed](https://attack.mitre.org/software/S0622) has the ability to Base64 encode its payload and custom encrypt API calls.(Citation: Malwarebytes...
S1118	BUSHWALK	Malware	[BUSHWALK](https://attack.mitre.org/software/S1118) can encrypt the resulting data generated from C2 commands with RC4.(Citation: Mandiant Cutting Edg...
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL name...
S1226	BOOKWORM	Malware	[BOOKWORM](https://attack.mitre.org/software/S1226) has been delivered using self-extracting RAR archives.(Citation: Unit42 Bookworm Nov2015)
S0138	OLDBAIT	Malware	[OLDBAIT](https://attack.mitre.org/software/S0138) obfuscates internal strings and unpacks them at startup.(Citation: FireEye APT28)
S0560	TEARDROP	Malware	[TEARDROP](https://attack.mitre.org/software/S0560) created and read from a file with a fake JPG header, and its payload was encrypted with a simple r...
S0647	Turian	Malware	[Turian](https://attack.mitre.org/software/S0647) can use VMProtect for obfuscation.(Citation: ESET BackdoorDiplomacy Jun 2021)

References

• Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
• Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
• Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved November 17, 2024.
• Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.
• Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.
• White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.

Frequently Asked Questions

What is T1027 (Obfuscated Files or Information)?

T1027 is a MITRE ATT&CK technique named 'Obfuscated Files or Information'. It belongs to the Stealth tactic(s). Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavi...

How can T1027 be detected?

Detection of T1027 (Obfuscated Files or Information) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1027?

There are 4 documented mitigations for T1027. Key mitigations include: User Training, Behavior Prevention on Endpoint, Antivirus/Antimalware, Audit.

Which threat groups use T1027?

Known threat groups using T1027 include: GALLIUM, APT3, Kimsuky, APT41, Gamaredon Group, Gallmaker, Sandworm Team, Mustang Panda.