MITRE ATT&CKsub-technique

T1027.016 Junk Code Insertion

Published 2025-03-04 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2025-03-04

Description

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing. No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them. The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1049 Antivirus/Antimalware mitigation

Referenced by MITRE ATT&CK · uses (27)

  • S9062 MiniBrowse software (malware)
  • S9053 MiniJunk software (malware)
  • S9027 ANELLDR software (malware)
  • S9020 LODEINFO software (malware)
  • S9025 NOOPLDR software (malware)
  • S9019 PureCrypter software (malware)
  • S1183 StrelaStealer software (malware)
  • S0666 Gelsemium software (malware)
  • S0612 WastedLocker software (malware)
  • G0129 Mustang Panda group
  • S0512 FatDuke software (malware)
  • S0477 Goopy software (malware)
  • S0453 Pony software (malware)
  • S0449 Maze software (malware)
  • G0099 APT-C-36 group
  • G0094 Kimsuky group
  • S0370 SamSam software (malware)
  • G0082 APT38 group
  • S0248 yty software (malware)
  • S0223 POWERSTATS software (malware)
  • S0230 ZeroT software (malware)
  • S0182 FinFisher software (malware)
  • G0050 APT32 group
  • G0046 FIN7 group
  • G0047 Gamaredon Group group
  • S0117 XTunnel software (malware)
  • S0137 CORESHELL software (malware)

References