{"id":125,"date":"2025-02-14T20:18:52","date_gmt":"2025-02-14T20:18:52","guid":{"rendered":"https:\/\/www.cyberguard6.com\/blog\/?p=125"},"modified":"2025-02-14T21:29:42","modified_gmt":"2025-02-14T21:29:42","slug":"how-base64-encapsulation-hides-malicious-shellcode","status":"publish","type":"post","link":"https:\/\/www.cyberguard6.com\/blog\/how-base64-encapsulation-hides-malicious-shellcode\/","title":{"rendered":"Unmasking Threat Actors: How Base64 Encapsulation Hides Malicious Shellcode"},"content":{"rendered":"

Threat actors constantly evolve their obfuscation techniques to evade detection by security tools and analysts. One common technique is encoding payloads in Base64. However, simply decoding the Base64 string often reveals another layer of obfuscation\u2014usually in the form of shellcode, which requires further analysis to uncover its true intent. In this post, we\u2019ll explore why attackers use this method and how tools like CyberChef and scdbg can be used to analyze and reverse malicious shellcode.<\/p>\n

Why Do Threat Actors Use Base64?<\/h2>\n

Base64 encoding is not inherently malicious; it\u2019s widely used for data transmission, such as encoding binary files or authentication tokens. However, threat actors leverage Base64 encoding for several reasons:<\/p>\n