Description
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023)
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)
Platforms
Threat Groups (38)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used the RC4 algorithm to decrypt configuration data. (Citation: 1 - appv) |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) has encoded commands in base64-encoded sections concatenated together in PowerShell.(Citation: FBI ... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has decoded malicious VBScripts using Base64.(Citation: Talos Kimsuky Nov 2021) [Kimsuky](https://att... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used Base64-encoded data to transfer payloads and commands, including deobfuscation via [cer... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) malware can decode contents from a payload that was Base64 encoded and write the contents to a f... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used [certutil](https://attack.mitre.org/software/S0160) in a macro to decode base64-encoded con... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has decoded base64-encoded PowerShell, JavaScript, and VBScript.(Citation: FireEye MuddyWater Mar ... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) tools decrypted additional payloads from the C2. [Gamaredon Group](https://attack.mitre.org/g... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has distributed password-protected archives such as ZIP files during intrusions.(Citation: rapid7-... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used a script that decodes a Base64-encoded version of WeaveWorks Scope.(Citation: Cisco Talos In... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034)'s VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also ... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has the ability to decrypt its payload prior to execution.(Citation: Lab52 MUSTANG PANDA PUBLOA... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.(Citation: Check Poin... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has extracted tar.gz files after downloading them from a C2 server.(Citation: Talos Rocke August 2018) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020) |
| G0049 | OilRig | A [OilRig](https://attack.mitre.org/groups/G0049) macro has run a PowerShell command to decode file contents. [OilRig](https://attack.mitre.org/groups... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: M... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) used shellcode with an XOR algorithm to decrypt a payload. [Tropic Trooper](https://attack.mit... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) has deobfuscated Base64-encoded shellcode strings prior to loading them.(Citation: Microsoft NICKEL ... |
Associated Software (301)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) decodes the configuration data and modules.(Citation: Fidelis TrickBot Oct 2016)(Citation: Cyberre... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has used AES and XOR to decrypt its DLLs.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1100 | Ninja | Malware | The [Ninja](https://attack.mitre.org/software/S1100) loader component can decrypt and decompress the payload.(Citation: Kaspersky ToddyCat June 2022)(... |
| S1145 | Pikabot | Malware | [Pikabot](https://attack.mitre.org/software/S1145) decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers w... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has used a custom XOR algorithm to decrypt the payload.(Citation: Unit42 Molerat Mar 2020) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can deobfuscate C2 server responses and unpack its code on targeted hosts.(Citation: Proofpoint B... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has decoded its encrypted C2 traffic prior to execution.(Citation: CrowdStrike BRICKSTORM WARP P... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has decoded antivirus name strings.(Citation: Korean FSI TA505 2020) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) has used XOR and Base64 to decode C2 data.(Citation: McAfee Lazarus Nov 2020) |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) uses a unique, custom de-obfuscation technique.(Citation: Unit 42 NOKKI Sept 2018) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) decrypts resources that are loaded into memory and executed.(Citation: Nicolas Falliere, Liam O Mur... |
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) can deobfuscate the next stage payload using Base64 and XOR operations with the key "53".(Citation... |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) uses the AES algorithm, bit shifts in a function called `rotate`, and an XOR cipher to decrypt r... |
| S1053 | AvosLocker | Malware | [AvosLocker](https://attack.mitre.org/software/S1053) has deobfuscated XOR-encoded strings.(Citation: Malwarebytes AvosLocker Jul 2021) |
| S1041 | Chinoxy | Malware | The [Chinoxy](https://attack.mitre.org/software/S1041) dropping function can initiate decryption of its config file.(Citation: Bitdefender FunnyDream ... |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) has decompressed data received from the C2 server.(Citation: BleepingComputer Molerats Dec 2020) |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) decodes configuration items from a bundled file for command and control activity.(Citation: NCSC... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.(Ci... |
| S0226 | Smoke Loader | Malware | [Smoke Loader](https://attack.mitre.org/software/S0226) deobfuscates its code.(Citation: Talos Smoke Loader July 2018) |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to decrypt strings using hard-coded AES keys.(Citation: objective-see windtail1 de... |
References
- Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
- Aleksandar Milenkoski, Juan Andres Guerrero-Saade, and Joey Chen. (2023, March 23). Operation Tainted Love | Chinese APTs Target Telcos in New Attacks. Retrieved March 18, 2025.
- Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.
- Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.
Frequently Asked Questions
What is T1140 (Deobfuscate/Decode Files or Information)?
T1140 is a MITRE ATT&CK technique named 'Deobfuscate/Decode Files or Information'. It belongs to the Stealth tactic(s). Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deob...
How can T1140 be detected?
Detection of T1140 (Deobfuscate/Decode Files or Information) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1140?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1140?
Known threat groups using T1140 include: APT38, BlackByte, Kimsuky, Volt Typhoon, Gorgon Group, menuPass, MuddyWater, Gamaredon Group.