Procedure examples

Cuba has a packed payload when delivered.

Mongall has been packed with Themida.

LockBit 3.0 can use code packing to hinder analysis.

The Latrodectus payload has been packed for obfuscation.

Saint Bot has been packed using a dark market crypter.

Sagerunex has used VMProtect to pack and obscure itself.

Uroburos uses a custom packer.

Metamorfo has used VMProtect to pack and protect files.

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

KONNI has been packed for obfuscation.

RedLine Stealer has used obfuscation tools such as DNGuard and Boxed App to pack their code.

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

SDBbot has used a packed installer file.

StrelaStealer variants have used packers to obfuscate payloads and make analysis more difficult.

LiteDuke has been packed with multiple layers of encryption.

Bazar has a variant with a packed payload.

XLoader uses various packers, including CyaX, to obfuscate malicious executables.

Zebrocy's Delphi variant was packed with UPX.

A FinFisher variant uses a custom packer.

HotCroissant has used the open source UPX executable packer.

Valak has used packed DLL payloads.

OSX_OCEANLOTUS.D has a variant that is packed with UPX.

A version of Daserf uses the MPRESS packer.

SysUpdate has been packed with VMProtect.

Clop has been packed to help avoid detection.

Lokibot has used several packing methods for obfuscation.

Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

Melcoz has been packed with VMProtect and Themida.

Troll Stealer has been delivered as a VMProtect-packed binary.

Astaroth uses a software packer called Pe123\RPolyCryptor.

QakBot can encrypt and pack malicious payloads.

jRAT payloads have been packed.

Dok is packed with an UPX executable packer.

H1N1 uses a custom packing algorithm.

CSPY Downloader has been packed with UPX.

Donut can generate packed code modules.

For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.

During Operation Ghost, APT29 used steganography to hide payloads inside valid images.

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.

Andariel has hidden malicious executables within PNG files.

APT37 uses steganography to send images to users that are embedded with shellcode.

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.

Leviathan has used steganography to hide stolen data inside other files stored on Github.

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.

TA551 has hidden encoded data for malware DLLs in a PNG.

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

Earth Lusca has used steganography to hide shellcode in a BMP image file.

PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).

Pikabot loads a set of PNG images stored in the malware's resources section (RCDATA), each with an encrypted section containing portions of the core Pikabot core module. These sections are loaded and decrypted using a bitwise XOR operation with a hardcoded 32 bit key.

Avenger can extract backdoor malware from downloaded images.