Procedure examples

Machete has been packed with NSIS.

Squirrelwaffle has been packed with a custom packer to hide payloads.

Hildegard has packed ELF files into other binaries.

FYAnti has used ConfuserEx to pack its .NET module.

Some ZeroT DLL files have been packed with UPX.

Raspberry Robin contains multiple payloads that are packed for defense evasion purposes and unpacked on runtime.

Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.

IcedID has packed and encrypted its loader module.

VERMIN is initially packed.

DarkComet has the option to compress its payload using UPX or MPRESS.

FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

Lucifer has used UPX packed binaries.

DRATzarus's dropper can be packed with UPX.

ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

China Chopper's client component is packed with UPX.

GoldMax has been packed for obfuscation.

CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.

HyperBro has the ability to pack its payload.

Anchor has come with a packed payload.

Versions of Babuk have been packed.

Dyre has been delivered with encrypted resources and must be unpacked for execution.

Bisonal has used the MPRESS packer and similar tools for obfuscation.

Some S-Type samples have been packed with UPX.

SeaDuke has been packed with the UPX packer.

Cuba has a packed payload when delivered.

Mongall has been packed with Themida.

LockBit 3.0 can use code packing to hinder analysis.

The Latrodectus payload has been packed for obfuscation.

Saint Bot has been packed using a dark market crypter.

Sagerunex has used VMProtect to pack and obscure itself.

Uroburos uses a custom packer.

Metamorfo has used VMProtect to pack and protect files.

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

KONNI has been packed for obfuscation.

RedLine Stealer has used obfuscation tools such as DNGuard and Boxed App to pack their code.

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

SDBbot has used a packed installer file.

StrelaStealer variants have used packers to obfuscate payloads and make analysis more difficult.

LiteDuke has been packed with multiple layers of encryption.

Bazar has a variant with a packed payload.

XLoader uses various packers, including CyaX, to obfuscate malicious executables.

Zebrocy's Delphi variant was packed with UPX.

A FinFisher variant uses a custom packer.

HotCroissant has used the open source UPX executable packer.

Valak has used packed DLL payloads.

OSX_OCEANLOTUS.D has a variant that is packed with UPX.

A version of Daserf uses the MPRESS packer.

SysUpdate has been packed with VMProtect.

Clop has been packed to help avoid detection.

Lokibot has used several packing methods for obfuscation.