Skip to content

Multi-layer obfuscation

Named by 2 kept items in this workspace.

Search every workspace for Multi-layer obfuscation. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Supply Chain Compromise of axios npm Package
    writeup2026-03-31

    Reversed Base64 encoding combined with XOR cipher (key 'OrDeR_7077') to hide module names, C2 URL, shell commands, and file paths in setup.js

  • Dissecting CrashFix: KongTuke's New Toy
    writeup2026-01-16It is written here as Multi-layer obfuscation (Base64, XOR, ROT cipher, custom token lookup table).

    Successive payload stages use ROT cipher encoded CharCode blobs, layered Base64/XOR encoding, and a custom 256-entry 3-character token lookup table to obscure PowerShell code instead of standard encodings.

All techniques in this workspace.