Capture Evasion

Malware has characteristics enabling it to evade capture from the infected system.

Methods

Name	ID	Description
Encrypted Payloads	B0036.002	The decryption key is stored external to the executable or never touches the disk.
Memory-only Payload	B0036.001	Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).
Multiple Stages of Loaders	B0036.003	Multiple stages of loaders are used with an encoded payload.

Name	Date	Method	Description
Vobfus	2016	B0036.002	Vobfus is downloaded in an encrypted form then decrypted. [1]
TEARDROP	2018	B0036.001	TEARDROP loads its payload only into memory. [2]
Matanbuchus	2021	B0036.001	The malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [4]
Matanbuchus	2021	B0036.003	Matanbuchus consists of 2 loaders. [3] [4]