Obfuscated Files or Information: Software Packing

APT29 used UPX to pack files.^[31]

APT3 has been known to pack their tools.^[33]

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.^[34]

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.^[37][38]

Astaroth uses a software packer called Pe123\RPolyCryptor.^[18]

China Chopper's client component is packed with UPX.^[21]

Dark Caracal has used UPX to pack Bandook.^[35]

DarkComet has the option to compress its payload using UPX or MPRESS.^[16]

A version of Daserf uses the MPRESS packer.^[5]

Dyre has been delivered with encrypted resources and must be unpacked for execution.^[29]

Elderwood has packed malware payloads before delivery to victims.^[30]

Emotet has used custom packers to protect its payloads.^[17]

A FinFisher variant uses a custom packer.^[14][15]

GreyEnergy is packed for obfuscation.^[11]

H1N1 uses a custom packing algorithm.^[3]

HotCroissant has used the open source UPX executable packer.^[25]

jRAT payloads have been packed.^[22]

Lokibot has used several packing methods for obfuscation.^[27]

Machete has been packed with NSIS.^[24]

Night Dragon is known to use software packing in its tools.^[36]

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.^[7]

OSX_OCEANLOTUS.D has a variant that is packed with UPX.^[23]

A Patchwork payload was packed with UPX.^[32]

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.^[41][42][43]

SDBot has used a packed installer file.^[28]

SeaDuke has been packed with the UPX packer.^[6]

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.^[26]

Soft Cell packed some payloads using different types of packers, both known and custom.^[40]

TA505 has used UPX to obscure malicious code.^[28]

The White Company has obfuscated their payloads through packing.^[39]

TrickBot leverages a custom packer to obfuscate its functionality.^[8]

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.^[10]

Uroburos uses a custom packer.^[13]

VERMIN is initially packed.^[4]

yty packs a plugin with UPX.^[9]

Zebrocy's Delphi variant was packed with UPX.^[19][20]

Some ZeroT DLL files have been packed with UPX.^[12]

Employ heuristic-based malware detection. Ensure updated virus definitions and create custom signatures for observed malware.