T1027 Obfuscated Files or Information in real malware
ATT&CK technique T1027 Obfuscated Files or Information appears in 5 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: CobaltStrikeStager, Razy.
Tactics: stealth
Prevalence in the corpus
- Samples exhibiting T1027: 5
- Share of analyzed corpus: 0.0%
- Last 7 days: 0 · prior 7 days: 0 (flat)
Malware families using T1027
- CobaltStrikeStager - 1 sample
- Razy - 1 sample
Example samples
- c261d38419991cfdbd46ef65acfa3668340b9cfa31e82d2137c3d355a0d5a50b - malicious
- bb8db1a5f16af7b28037d1ac71260019b7b8fa07c0d5d32ce11b97054bd80c81 - malicious
- ed196b864836e86beeb5a664d06cfc7b81613a829507013fcb5bb05d0ddb75d8 - malicious
- 441323f68e3e7c086cd16781aeb8df2b7618a32d0c4132013e596d4eb2455eb7 - malicious
- ed1b08ba51408930dce8642935f5eae7a0b88c167158ab0ebca2b36ca94fd7a9 - suspicious
Canonical technique definition: MITRE ATT&CK T1027 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1027
- How common is ATT&CK T1027 (Obfuscated Files or Information) in real malware?
- ATT&CK technique T1027 Obfuscated Files or Information appears in 5 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: CobaltStrikeStager, Razy.
- Which malware families use T1027?
- In this corpus T1027 is most associated with CobaltStrikeStager (1), Razy (1). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1027?
- 0.0% of the publicly analyzed corpus (5 of 114578 samples) exhibits T1027. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats