UUIDfuscation

2024-08-05

UUIDfuscation is the process of using UUIDs to encode and obfuscate malware.

A UUID is made up of 5 segments of different sizes and may look something like this:

ddbf1230-1057-444c-ae99-aa1b4cd9e3ff

The first three segments are represented as little-endian, which makes encoding and decoding slightly tricky, as the software implementing UUIDfuscation must take byte order into account.

The WinAPI function UuidFromStringA converts UUID strings to binary.

https://github.com/Spnl48/FogShell


No notes link to this note