Procedure examples

StrelaStealer variants have used packers to obfuscate payloads and make analysis more difficult.

LiteDuke has been packed with multiple layers of encryption.

Bazar has a variant with a packed payload.

XLoader uses various packers, including CyaX, to obfuscate malicious executables.

Zebrocy's Delphi variant was packed with UPX.

A FinFisher variant uses a custom packer.

HotCroissant has used the open source UPX executable packer.

Valak has used packed DLL payloads.

OSX_OCEANLOTUS.D has a variant that is packed with UPX.

A version of Daserf uses the MPRESS packer.

SysUpdate has been packed with VMProtect.

Clop has been packed to help avoid detection.

Lokibot has used several packing methods for obfuscation.

Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

Melcoz has been packed with VMProtect and Themida.

Troll Stealer has been delivered as a VMProtect-packed binary.

Astaroth uses a software packer called Pe123\RPolyCryptor.

QakBot can encrypt and pack malicious payloads.

jRAT payloads have been packed.

Dok is packed with an UPX executable packer.

H1N1 uses a custom packing algorithm.

CSPY Downloader has been packed with UPX.

Donut can generate packed code modules.