Threat intelligence / Technique

Deobfuscate/Decode Files or Information

Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

353 recorded

Relationships

uses

from 2025 Poland Wiper Attacks

Campaign

uses

from ABK

Malware

uses

from Action RAT

Malware

uses

from Agent Tesla

Malware

uses

from Agrius

Group

uses

from Amadey

Malware

uses

from ANELLDR

Malware

uses

from Apostle

Malware

uses

from AppleJeus

Malware

uses

from AppleSeed

Malware

uses

from APT19

Group

uses

from APT28

Group

uses

from APT28 Nearest Neighbor Campaign

Campaign

uses

from APT38

Group

uses

from APT39

Group

uses

from ArcaneDoor

Campaign

uses

from Aria-body

Malware

uses

from AshTag

Malware

uses

from Astaroth

Malware

uses

from AuditCred

Malware

uses

from Avaddon

Malware

uses

from Avenger

Malware

uses

from AvosLocker

Malware

uses

from Azorult

Malware

uses

from Babuk

Malware

uses

from BabyShark

Malware

uses

from BackConfig

Malware

uses

from BADFLICK

Malware

uses

from Bandook

Malware

uses

from Bankshot

Malware

uses

from Bazar

Malware

uses

from BBK

Malware

uses

from BBSRAT

Malware

uses

from BendyBear

Malware

uses

from Bisonal

Malware

uses

from BlackByte

Group

uses

from BlackByte Ransomware

Malware

uses

from BLINDINGCAN

Malware

uses

from BOOKWORM

Malware

uses

from BoomBox

Malware

uses

from BOOSTWRITE

Malware

uses

from BRICKSTORM

Malware

uses

from BRONZE BUTLER

Group

uses

from BRUSHFIRE

Malware

uses

from Brute Ratel C4

Tool

uses

from Bumblebee

Malware

uses

from Bundlore

Malware

uses

from BUSHWALK

Malware

uses

from C0017

Campaign

uses

from C0021

Campaign

uses

from Caminho

Malware

uses

from CanisterWorm

Malware

uses

from Carbon

Malware

uses

from Cardinal RAT

Malware

uses

from CASTLETAP

Malware

uses

from certutil

Tool

uses

from Chaes

Malware

uses

from CharmPower

Malware

uses

from CHIMNEYSWEEP

Malware

uses

from Chinoxy

Malware

uses

from Chrommme

Malware

uses

from Cinnamon Tempest

Group

uses

from CLAIMLOADER

Malware

uses

from Clambling

Malware

uses

from Clop

Malware

uses

from COATHANGER

Malware

uses

from Cobalt Strike

Malware

uses

from CoinTicker

Malware

uses

from ComRAT

Malware

uses

from Conti

Malware

uses

from CookieMiner

Malware

uses

from CorKLOG

Malware

uses

from CostaBricks

Malware

uses

from Crimson

Malware

uses

from Cuckoo Stealer

Malware

uses

from Cyclops Blink

Malware

uses

from DanBot

Malware

uses

from DarkGate

Malware

uses

from Darkhotel

Group

uses

from DarkTortilla

Malware

uses

from DarkWatchman

Malware

uses

from DDKONG

Malware

uses

from DEADEYE

Malware

uses

from DEADWOOD

Malware

uses

from Denis

Malware

uses

from DOWNIISSA

Malware

uses

from DropBook

Malware

uses

from Drovorub

Malware

uses

from Dtrack

Malware

uses

from DUSTPAN

Malware

uses

from DUSTTRAP

Malware

uses

from Dyre

Malware

uses

from Earth Lusca

Group

uses

from Ebury

Malware

uses

from Ecipekac

Malware

uses

from Egregor

Malware

uses

from Embargo

Malware

uses

from Emotet

Malware

uses

from EnvyScout

Malware

uses

from Exaramel for Linux

Malware

uses

from Exbyte

Malware

uses

from Expand

Tool

uses

from FatDuke

Malware

uses

from FIN13

Group

uses

from FIN7

Group

uses

from Final1stspy

Malware

uses

from FinFisher

Malware

uses

from FIVEHANDS

Malware

uses

from FoggyWeb

Malware

uses

from Fooder

Malware

uses

from FRAMESTING

Malware

uses

from Frankenstein

Campaign

uses

from FYAnti

Malware

uses

from Gamaredon Group

Group

uses

from Gelsemium

Malware

uses

from gh0st RAT

Malware

uses

from GLASSTOKEN

Malware

uses

from GlassWorm

Malware

uses

from GoldMax

Malware

uses

from Goopy

Malware

uses

from Gootloader

Malware

uses

from Gorgon Group

Group

uses

from Grandoreiro

Malware

uses

from Green Lambert

Malware

uses

from GrimAgent

Malware

uses

from Hancitor

Malware

uses

from HeartCrypt

Malware

uses

from HermeticWiper

Malware

uses

from HexEval Loader

Malware

uses

from Heyoka Backdoor

Malware

uses

from HiddenFace

Malware

uses

from HiddenWasp

Malware

uses

from Higaisa

Group

uses

from Hildegard

Malware

uses

from HTTPTroy

Malware

uses

from HUI Loader

Malware

uses

from HyperBro

Malware

uses

from IceApple

Malware

uses

from Imminent Monitor

Tool

uses

from INC Ransomware

Malware

uses

from Industroyer

Malware

uses

from InvisibleFerret

Malware

uses

from InvisiMole

Malware

uses

from IronNetInjector

Tool

uses

from IronWind

Malware

uses

from ISMInjector

Malware

uses

from Juicy Mix

Campaign

uses

from Kapeka

Malware

uses

from Ke3chang

Group

uses

from Kerrdown

Malware

uses

from Kessel

Malware

uses

from KEYPLUG

Malware

uses

from KGH_SPY

Malware

uses

from Kimsuky

Group

uses

from Kobalos

Malware

uses

from KOCTOPUS

Malware

uses

from KONNI

Malware

uses

from Kwampirs

Malware

uses

from LAMEHUG

Malware

uses

from Latrodectus

Malware

uses

from Lazarus Group

Group

uses

from Leviathan

Group

uses

from LightNeuron

Malware

uses

from LIGHTWIRE

Malware

uses

from Line Dancer

Malware

uses

from LiteDuke

Malware

uses

from Lizar

Malware

uses

from LockBit 2.0

Malware

uses

from LockBit 3.0

Malware

uses

from Lokibot

Malware

uses

from LookBack

Malware

uses

from LP-Notes

Malware

uses

from Lucifer

Malware

uses

from Lumma Stealer

Malware

uses

from LunarLoader

Malware

uses

from LunarMail

Malware

uses

from LunarWeb

Malware

uses

from Machete

Malware

uses

from MacMa

Malware

uses

from Mafalda

Malware

uses

from MagicRAT

Malware

uses

from Malteiro

Group

uses

from Medusa Ransomware

Malware

uses

from MegaCortex

Malware

uses

from menuPass

Group

uses

from MESSAGETAP

Malware

uses

from metaMain

Malware

uses

from Metamorfo

Malware

uses

from Mini Shai-Hulud

Malware

uses

from MirageFox

Malware

uses

from Mispadu

Malware

uses

from Molerats

Group

uses

from Mongall

Malware

uses

from Moonstone Sleet

Group

uses

from MOPSLED

Malware

uses

from More_eggs

Malware

uses

from Mori

Malware

uses

from MuddyViper

Malware

uses

from MuddyWater

Group

uses

from Mustang Panda

Group

uses

from NativeZone

Malware

uses

from Netwalker

Malware

uses

from Nightdoor

Malware

uses

from Ninja

Malware

uses

from NOKKI

Malware

uses

from NOOPLDR

Malware

uses

from ODAgent

Malware

uses

from OilBooster

Malware

uses

from OilRig

Group

uses

from Okrum

Malware

uses

from OnionDuke

Malware

uses

from OopsIE

Malware

uses

from Operation Dust Storm

Campaign

uses

from Operation Honeybee

Campaign

uses

from Operation Spalax

Campaign

uses

from OSX_OCEANLOTUS.D

Malware

uses

from OSX/Shlayer

Malware

uses

from P.A.S. Webshell

Malware

uses

from PcShare

Tool

uses

from PHASEJAM

Malware

uses

from PHPsert

Malware

uses

from Pikabot

Malware

uses

from Pillowmint

Malware

uses

from PingPull

Malware

uses

from PipeMon

Malware

uses

from PITSTOP

Malware

uses

from PlugX

Malware

uses

from PoetRAT

Malware

uses

from PolyglotDuke

Malware

uses

from PowerExchange

Malware

uses

from PowerLess

Malware

uses

from POWERSTATS

Malware

uses

from PowGoop

Malware

uses

from Proton

Malware

uses

from PS1

Malware

uses

from Pteranodon

Malware

uses

from PUBLOAD

Malware

uses

from PUNCHBUGGY

Malware

uses

from PureCrypter

Malware

uses

from PyDCrypt

Malware

uses

from QakBot

Malware

uses

from QUADAGENT

Malware

uses

from QUIETCANARY

Malware

uses

from Raccoon Stealer

Malware

uses

from Raindrop

Malware

uses

from RainyDay

Malware

uses

from Ramsay

Malware

uses

from RansomHub

Malware

uses

from RAPIDPULSE

Malware

uses

from Raspberry Robin

Malware

uses

from RDAT

Malware

uses

from RedLine Stealer

Malware

uses

from RedPenguin

Campaign

uses

from RegDuke

Malware

uses

from Remexi

Malware

uses

from REPTILE

Malware

uses

from REvil

Malware

uses

from RGDoor

Malware

uses

from RIFLESPINE

Malware

uses

from Rising Sun

Malware

uses

from ROADSWEEP

Malware

uses

from ROAMINGHOUSE

Malware

uses

from Rocke

Group

uses

from RogueRobin

Malware

uses

from ROKRAT

Malware

uses

from RotaJakiro

Malware

uses

from RustyWater

Malware

uses

from Sagerunex

Malware

uses

from Saint Bot

Malware

uses

from SampleCheck5000

Malware

uses

from Sandworm Team

Group

uses

from Sardonic

Malware

uses

from SDBbot

Malware

uses

from ShadowPad

Malware

uses

from Shamoon

Malware

uses

from SharePoint ToolShell Exploitation

Campaign

uses

from Shark

Malware

uses

from SharpStage

Malware

uses

from ShimRat

Malware

uses

from Sibot

Malware

uses

from SideTwist

Malware

uses

from Siloscape

Malware

uses

from Skidmap

Malware

uses

from SLIGHTPULSE

Malware

uses

from Smoke Loader

Malware

uses

from Snip3

Malware

uses

from SolarWinds Compromise

Campaign

uses

from SombRAT

Malware

uses

from SoreFang

Malware

uses

from Spark

Malware

uses

from SPAWNCHIMERA

Malware

uses

from Spica

Malware

uses

from SplatDropper

Malware

uses

from SQLRat

Malware

uses

from Squirrelwaffle

Malware

uses

from Starloader

Malware

uses

from StarProxy

Malware

uses

from STEADYPULSE

Malware

uses

from StealBit

Malware

uses

from Storm-1811

Group

uses

from StrelaStealer

Malware

uses

from Stuxnet

Malware

uses

from SUNSPOT

Malware

uses

from SystemBC

Malware

uses

from SysUpdate

Malware

uses

from TA505

Group

uses

from Taidoor

Malware

uses

from TeamPCP Cloud Stealer

Malware

uses

from TeamTNT

Group

uses

from TEARDROP

Malware

uses

from THINCRUST

Malware

uses

from Threat Group-3390

Group

uses

from ThreatNeedle

Malware

uses

from TONESHELL

Malware

uses

from Torisma

Malware

uses

from TrickBot

Malware

uses

from Tropic Trooper

Group

uses

from TSCookie

Malware

uses

from Tsundere Botnet

Malware

uses

from Turian

Malware

uses

from Turla

Group

uses

from TYPEFRAME

Malware

uses

from UPSTYLE

Malware

uses

from Uroburos

Malware

uses

from Ursnif

Malware

uses

from Valak

Malware

uses

from VaporRage

Malware

uses

from VERMIN

Malware

uses

from Volgmer

Malware

uses

from Volt Typhoon

Group

uses

from WarzoneRAT

Malware

uses

from WastedLocker

Malware

uses

from Waterbear

Malware

uses

from Water Curupira Pikabot Distribution

Campaign

uses

from WellMail

Malware

uses

from WellMess

Malware

uses

from WhisperGate

Malware

uses

from WindTail

Malware

uses

from Winnti for Linux

Malware

uses

from Winnti for Windows

Malware

uses

from Winter Vivern

Group

uses

from WIREFIRE

Malware

uses

from WIRTE

Group

uses

from Woody RAT

Malware

uses

from xCaon

Malware

uses

from XLoader

Malware

uses

from XORIndex Loader

Malware

uses

from YAHOYAH

Malware

uses

from Zebrocy

Malware

uses

from ZeroT

Malware

uses

from Zeus Panda

Malware

uses

from ZIRCONIUM

Group

uses

from ZxxZ

Malware

5 external

References

mitre-attack

T1140

open

Volexity PowerDuke November 2016

https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/

open

Sentinel One Tainted Love 2023

https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/

open

Malwarebytes Targeted Attack against Saudi Arabia

https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/

open

Carbon Black Obfuscation Sept 2016

https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/

open