Higaisa named a shellcode loader binary

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1220|XSL Script Processing|

Higaisa used an XSL file to run VBScript code.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Higaisa used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Higaisa discovered system proxy settings and used them if available.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Higaisa used HTTP and HTTPS to send data back to its C2 server.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1001.003|Protocol Impersonation|

Higaisa used a FakeTLS session for C2 communications.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

Higaisa used AES-128 to encrypt C2 traffic.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Higaisa used