value:  BLINDINGCAN has been packed with the UPX packer. ;; China Chopper's client component is packed with UPX. ;; CSPY Downloader has been packed with UPX. ;; Dark Caracal has used UPX to pack Bandook. ;; DarkComet has the option to compress its payload using UPX or MPRESS. ;; A version of Daserf uses the MPRESS packer. ;; Dyre has been delivered with encrypted resources and must be unpacked for execution. ;; Egregor's payloads are custom-packed archived and encrypted to prevent analysis. ;; Elderwood has packed malware payloads before delivery to victims. ;; Emotet has used custom packers to protect its payloads. ;; FatDuke has been regularly repacked by its operators to create large binaries and evade detection. ;; A FinFisher variant uses a custom packer. ;; GALLIUM packed some payloads using different types of packers both known and custom. ;; GoldMax has been packed for obfuscation. ;; GreyEnergy is packed for obfuscation. ;; H1N1 uses a custom packing algorithm. ;; Hildegard has packed ELF files into other binaries. ;; HotCroissant has used the open source UPX executable packer. ;; IcedID has packed and encrypted its loader module. ;; jRAT payloads have been packed. ;; Lazarus Group has used Themida to pack at least two separate backdoor implants. ;; Lokibot has used several packing methods for obfuscation. ;; Lucifer has used UPX packed binaries. ;; Machete has been packed with NSIS. ;; Melcoz has been packed with VMProtect and Themida. ;; Metamorfo has used VMProtect to pack and protect files. ;; NETWIRE has used .NET packer tools to evade detection. ;; Night Dragon is known to use software packing in its tools. ;; OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2. ;; OSX_OCEANLOTUS.D has a variant that is packed with UPX. ;; A Patchwork payload was packed with UPX. ;; Raindrop used a custom packer for its Cobalt Strike payload which was compressed using the LZMA algorithm. ;; Rocke's miner has created UPX-packed files in the Windows Start Menu Folder. ;; SDBbot has used a packed installer file. ;; SeaDuke has been packed with the UPX packer. ;; ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack. ;; Spark has been packed with Enigma Protector to obfuscate its contents. ;; TA505 has used UPX to obscure malicious code. ;; The White Company has obfuscated their payloads through packing. ;; TrickBot leverages a custom packer to obfuscate its functionality. ;; Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer. ;; Uroburos uses a custom packer. ;; Valak has used packed DLL payloads. ;; VERMIN is initially packed. ;; yty packs a plugin with UPX. ;; Zebrocy's Delphi variant was packed with UPX. ;; Some ZeroT DLL files have been packed with UPX. ;; ZIRCONIUM has used multi-stage packers for exploit code.
name: Obfuscated Files or Information: Software Packing