Procedure examples

TrickBot leverages a custom packer to obfuscate its functionality.

BLINDINGCAN has been packed with the UPX packer.

Spark has been packed with Enigma Protector to obfuscate its contents.

Torisma has been packed with Iz4 compression.

yty packs a plugin with UPX.

The first stage of COATHANGER is delivered as a packed file.

Misdat was typically packed using UPX.

HeartCrypt can pack malicious Windows x86 and .NET payloads in order to evade detection.

AppleSeed has used UPX packers for its payload DLL.

NETWIRE has used .NET packer tools to evade detection.

GreyEnergy is packed for obfuscation.

Emotet has used custom packers to protect its payloads.

Tomiris has been packed with UPX.

Machete has been packed with NSIS.

Squirrelwaffle has been packed with a custom packer to hide payloads.

Hildegard has packed ELF files into other binaries.

FYAnti has used ConfuserEx to pack its .NET module.

Some ZeroT DLL files have been packed with UPX.

Raspberry Robin contains multiple payloads that are packed for defense evasion purposes and unpacked on runtime.

Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.

IcedID has packed and encrypted its loader module.

VERMIN is initially packed.

DarkComet has the option to compress its payload using UPX or MPRESS.

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

Lucifer has used UPX packed binaries.

DRATzarus's dropper can be packed with UPX.

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

China Chopper's client component is packed with UPX.

GoldMax has been packed for obfuscation.

CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.

HyperBro has the ability to pack its payload.

Anchor has come with a packed payload.

Versions of Babuk have been packed.

Dyre has been delivered with encrypted resources and must be unpacked for execution.

Bisonal has used the MPRESS packer and similar tools for obfuscation.

Some S-Type samples have been packed with UPX.

SeaDuke has been packed with the UPX packer.

Cuba has a packed payload when delivered.

Mongall has been packed with Themida.

LockBit 3.0 can use code packing to hinder analysis.

The Latrodectus payload has been packed for obfuscation.

Saint Bot has been packed using a dark market crypter.

Sagerunex has used VMProtect to pack and obscure itself.

Uroburos uses a custom packer.

Metamorfo has used VMProtect to pack and protect files.

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

KONNI has been packed for obfuscation.

RedLine Stealer has used obfuscation tools such as DNGuard and Boxed App to pack their code.

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

SDBbot has used a packed installer file.