Procedure examples

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

TA2541 has used a .NET packer to obfuscate malicious files.

Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.

The White Company has obfuscated their payloads through packing.

Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.

MoustachedBouncer has used malware plugins packed with Themida.

Storm-0501 has used Themida to pack Cobalt Strike payloads.

TA505 has used UPX to obscure malicious code.

APT29 used UPX to pack files.

Dark Caracal has used UPX to pack Bandook.

Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.

Threat Group-3390 has packed malware and tools, including using VMProtect.

TrickBot leverages a custom packer to obfuscate its functionality.

BLINDINGCAN has been packed with the UPX packer.

Spark has been packed with Enigma Protector to obfuscate its contents.

Torisma has been packed with Iz4 compression.

yty packs a plugin with UPX.

The first stage of COATHANGER is delivered as a packed file.

Misdat was typically packed using UPX.

HeartCrypt can pack malicious Windows x86 and .NET payloads in order to evade detection.

AppleSeed has used UPX packers for its payload DLL.

NETWIRE has used .NET packer tools to evade detection.

GreyEnergy is packed for obfuscation.

Emotet has used custom packers to protect its payloads.

Tomiris has been packed with UPX.

Machete has been packed with NSIS.

Squirrelwaffle has been packed with a custom packer to hide payloads.

Hildegard has packed ELF files into other binaries.

FYAnti has used ConfuserEx to pack its .NET module.

Some ZeroT DLL files have been packed with UPX.

Raspberry Robin contains multiple payloads that are packed for defense evasion purposes and unpacked on runtime.

Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.

IcedID has packed and encrypted its loader module.

VERMIN is initially packed.

DarkComet has the option to compress its payload using UPX or MPRESS.

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

Lucifer has used UPX packed binaries.

DRATzarus's dropper can be packed with UPX.

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

China Chopper's client component is packed with UPX.

GoldMax has been packed for obfuscation.

CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.

HyperBro has the ability to pack its payload.

Anchor has come with a packed payload.

Versions of Babuk have been packed.

Dyre has been delivered with encrypted resources and must be unpacked for execution.

Bisonal has used the MPRESS packer and similar tools for obfuscation.

Some S-Type samples have been packed with UPX.

SeaDuke has been packed with the UPX packer.