Sneaking an .exe file into a system without the anti-virus being aware of it is like trying to get a server rack past a security guard \u2014 it’s just that big and conspicuous. <\/p>\n\n\n\n
To get around this problem, attackers use packers \u2014 utilities that compress files and, in case of run-time packers, also obfuscate the code. The goal is to make the source code impossible to detect and analyze. It’s like taking that same rack, putting it in a hydraulic press, and squeezing it down to a size that will fit in the pocket of your coat. <\/p>\n\n\n\n
In this article, we’ll look at how attackers use basic packers, what to watch out for in a cloud sandbox, and how to use the information you can get during dynamic analysis for static research. <\/p>\n\n\n\n
In general, a packer is a program that compresses a file using an algorithm. For example, ZIP, RAR. Some packers, such as UPX, are specifically designed to compress an executable, obfuscating the code in the process. In the context of malware, this can be used as an evasion method. <\/p>\n\n\n\n
There are many types of packers. Both legitimate utilities (VMprotect, ASpack, Enigma Protector), and custom code written by hackers. But these are either less popular in attacks, so we’ll leave them out, or too complex for the scope of this article. <\/p>\n\n\n\n
This trio is the most commonly used for malicious purposes. The table below explains what they do, from simpler to more advanced:<\/p>\n\n\n\n
| \n Type:\u00a0 <\/th>\n | \n Used to:\u00a0 <\/th>\n | \n Used by:\u00a0 <\/th>\n <\/tr>\n |
|---|---|---|
| \n ZIP\u00a0 <\/td>\n | \n Compress a file or files into an archive.\u00a0 <\/td>\n | \n Various phishing campaigns\u00a0 <\/td>\n <\/tr>\n |
| \n SFX\u00a0 <\/td>\n | \n Bundle a compressed payload and executable module into a single archive.\u00a0 <\/td>\n | \n Malware (E.g. Lu0bot) , Various phishing campaigns\u00a0\u00a0 <\/td>\n <\/tr>\n |
| \n UPX\u00a0 <\/td>\n | \n Obfuscate the code by compressing and encrypting an executable. Can be corrupted to prevent unpacking.\u00a0 <\/td>\n | \n AgentTesla<\/a>, Gh0stRAT, RedLine<\/a>, PlanetStealer malware <\/td>\n <\/tr>\n <\/table>\n<\/div> |