Log in Request a demo

Attack technique

Deobfuscate/Decode Files or Information

Deobfuscate/Decode Files or Information is a technique where attackers unpack, decode or decrypt content they had hidden earlier, so it can be used on the target system.

In short

Deobfuscate/Decode Files or Information is a technique where attackers unpack, decode or decrypt content they had hidden earlier, so it can be used on the target system. The malware itself or built-in system utilities can do the work. MITRE tracks it as T1140 under the Stealth tactic.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1140ATT&CK technique
  2. Detection4ways to spot itDecoding followed by execution · Cross-platform tools
  3. Defences2ways to stop itAccept limited prevention · Focus on detection

How it works

Attackers often hide files or data to keep them from analysis. Before that content can be used, it has to be turned back into a usable form. This can be done by the malware itself or by utilities that are already present on the system.

MITRE gives two examples: using a built-in certificate utility to decode a remote access tool hidden inside a certificate file, and using standard Windows commands to reassemble fragments of a file into a malicious payload.

Sometimes the user has to take part. They may need to open a file or type a password for a protected archive that the attacker supplied.

A real example

Procedure examples listed by MITRE ATT&CK:

  • ABK can decrypt AES encrypted payloads.
  • AppleSeed can decode its payload before it runs.
  • Avaddon has decrypted encrypted strings.
  • Astaroth uses a fromCharCode() deobfuscation method to avoid writing execution commands in plain form and to hide its code.
  • An APT28 macro uses the certutil -decode command to decode a text file that stores a base64 encoded payload (MITRE ATT&CK lists APT28 as using this technique).

How to detect

  1. Built-in tools decoding content

    Watch for system utilities and script tools being used to decode, reassemble, decompress or decrypt files, especially soon after a file was staged or downloaded.

  2. Decoding followed by execution

    Decoding tools are often chained with script interpreters or with further execution of the unpacked payload, so look at the sequence of processes.

  3. Cross-platform tools

    On Linux and macOS, native encoding, compression and encryption utilities can play the same role, often after a download.

  4. Detection strategy MITRE lists

    DET0275, Detect Adversary Deobfuscation or Decoding of Files and Payloads.

How to defend

  1. Accept limited prevention

    MITRE states this technique cannot easily be mitigated with preventive controls because it abuses normal system features.

  2. Focus on detection

    Invest in monitoring of process activity and file changes so that decoding steps are noticed and reviewed.

Questions

What is Deobfuscate/Decode Files or Information (T1140)?

It is a Stealth technique where attackers unpack, decode or decrypt content they had hidden earlier, so it can be used on the target system. The malware itself or utilities already present on the system can do the work.

Why do attackers hide files and then decode them?

Attackers often hide files or data to keep them from analysis. Before that content can be used, it has to be turned back into a usable form. MITRE gives examples such as a built-in certificate utility decoding a remote access tool hidden inside a certificate file.

Does decoding need help from the user?

Sometimes. The user may need to open a file or type a password for a protected archive that the attacker supplied. In other cases the malware or built-in system tools decode the content without any user action.

How can I detect this technique?

Watch for system utilities and script tools being used to decode, reassemble, decompress or decrypt files, especially soon after a file was staged or downloaded. Decoding is often chained with script interpreters, so look at the sequence of processes.

Can T1140 be prevented?

Not easily. MITRE states this technique cannot easily be mitigated with preventive controls because it abuses normal system features. The advice is to focus on detection by monitoring process activity and file changes so decoding steps are noticed and reviewed.

In our research

  1. KageNoHitobito Ransomware Technical Analysis August 2024
  2. [Research Summary]: Rugmi Loader August 2024
  3. Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
  4. [Research Summary]: RokRat June 2024
  5. Xeno RAT Technical Analysis June 2024
  6. [Research Summary]: Mystic Stealer December 2023

Sources

  1. MITRE ATT&CK T1140: Deobfuscate/Decode Files or Information MITRE
  2. MITRE ATT&CK Tactic TA0005: Stealth MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

[Research Summary]: Rugmi Loader

Rugmi loader technical analysis: phishing delivery, DLL hijacking, direct syscalls, Heaven's Gate evasion, process injection, a stealer payload and defenses

Read more

Threat group

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Read more

Glossary term

Remote access trojan (RAT)

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read more