Procedure examples

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.

Elderwood has packed malware payloads before delivery to victims.

GALLIUM packed some payloads using different types of packers, both known and custom.

APT3 has been known to pack their tools.

Kimsuky has packed malware with UPX.

Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.

A Patchwork payload was packed with UPX.

APT41 uses packers such as Themida to obfuscate malicious files.

TeamTNT has used UPX and Ezuri packer to pack its binaries.

ZIRCONIUM has used multi-stage packers for exploit code.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

TA2541 has used a .NET packer to obfuscate malicious files.

Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.

The White Company has obfuscated their payloads through packing.

Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.

MoustachedBouncer has used malware plugins packed with Themida.

Storm-0501 has used Themida to pack Cobalt Strike payloads.

TA505 has used UPX to obscure malicious code.

APT29 used UPX to pack files.

Dark Caracal has used UPX to pack Bandook.

Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.

Threat Group-3390 has packed malware and tools, including using VMProtect.