#T1027.002 Software Packing

Technique

  • Tactics: Defense Evasion
  • Description:

    Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

    Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)

  • First Seen: Lazarus group Campaign Targeting The Cryptocurrency Vertical • 2020-08-18
MITRE ATT&CK

Tagged Reports

2024-08-05
KRNCSC
#Kimsuky #DoraRAT #TrollAgent #Andariel #T1119 #T1005 #T1083 #T1036 #T1074.001 #T1041 #T1113 #T1573.002 #T1195 #T1189 #T1204.002 #T1027.002 #T1071.001 #T1217
2024-07-15
Darkatlas
#Kimsuky #TrollAgent #T1005 #T1518.001 #T1059.003 #T1070.004 #T1083 #T1036 #T1539 #T1041 #T1113 #T1016 #T1555.003 #T1218.011 #T1087.001 #T1027.002 #T1071.001 #T1057 #T1082
2024-02-08
S2W
#D2Innovation #TrollStealer #Kimsuky #T1005 #T1518.001 #T1059.003 #T1083 #T1539 #T1059.001 #T1041 #T1588.004 #T1113 #T1016 #T1560 #T1555.003 #T1204.002 #T1087.001 #T1027.002 #T1071.001 #T1057 #T1082
2024-02-07
S2W
#D2Innovation #TrollStealer #Kimsuky #T1005 #T1518.001 #T1059.003 #T1083 #T1539 #T1059.001 #T1041 #T1588.004 #T1113 #T1016 #T1560 #T1555.003 #T1204.002 #T1087.001 #T1027.002 #T1071.001 #T1057 #T1082
2023-10-27
Kaspersky
#LPEClient #SIGNBT #T1574.002 #T1027.001 #T1620 #T1203 #T1083 #T1041 #T1113 #T1189 #T1003.001 #T1573.001 #T1547.012 #T1027.002 #T1132.002 #T1071.001 #T1140 #T1057 #T1082
2023-09-27
Ptsecurity
#MataDoor #DarkRiver #CVE-2021-40444 #T1090.001 #T1016 #T1106 #T1018 #T1622 #T1543.003 #T1027.002 #T1071 #T1057 #T1082 #T1572.001 #T1059.003 #T1566.001 #T1074.001 #T1572 #T1218.011 #T1620 #T1135 #T1049 #T1140 #T1030 #T1005 #T1036.004 #T1041 #T1129 #T1572.002 #T1571 #T1090.002 #T1046 #T1218.010 #T1132 #T1112 #T1083 #T1124 #T1033 #T1095 #T1560.002 #T1090.003 #T1008
2023-01-31
ESET
#Trend #T1102.002 #T1190 #T1027 #T1560.001 #T1567 #T1102 #T1027.002 #T1071 #T1574 #T1566.001 #T1566 #T1553.002 #T1090 #T1027.006 #T1567.002 #T1553 #T1584 #T1218 #T1027.007 #T1505 #T1505.003 #T1113 #T1555 #T1560 #T1071.004 #T1195 #T1204.002 #T1584.006 #T1218.001 #T1195.002 #T1574.002 #T1484.001 #T1484 #T1555.003 #T1204 #T1090.003 #T1003
2022-12-27
Kaspersky
#Bluenoroff #T1059.003 #T1204.001 #T1566.001 #T1218.007 #T1221 #T1041 #T1547.008 #T1059.005 #T1204.002 #T1566.002 #T1055.002 #T1218.011 #T1497.001 #T1027.002 #T1071.001 #T1553.005
2022-09-30
ESET
#BYOVD #T1106 #T1566.003 #T1027.002 #T1059.003 #T1566.001 #T1573.001 #T1218.011 #T1547.001 #T1140 #T1584.004 #T1587.001 #T1132.001 #T1014 #T1204.002 #T1547.006 #T1071.001 #T1574.002 #T1560.002 #T1070.006
2022-04-11
Cluster25
#KittyPhishing #T1573 #T1562.001 #T1203 #T1036 #T1106 #T1059.005 #T1027.002 #T1071 #T1568 #T1057 #T1082 #T1406 #T1518.001 #T1221 #T1566.001 #T1006 #T1547.001 #T1560 #T1105 #T1083 #T1497 #T1566.002
2021-12-02
SOCRadar
#Lazarus #T1090.001 #T1134.002 #T0865 #T1562.001 #T1543.003 #T1059.003 #T1074.001 #T1553.002 #T1485 #T1614.001 #T1591 #T1218.011 #T1620 #T1078 #T1587.001 #T1027.007 #T1010 #T1571 #T1090.002 #T1542.003 #T1583.001 #T1033 #T1497.001 #T1560.002 #T1203 #T1036 #T1012 #T1016 #T1059.005 #T1106 #T1027 #T1566.003 #T1027.002 #T1562.004 #T1529 #T1049 #T1140 #T1585.001 #T1005 #T1053.005 #T1564.001 #T1608.001 #T1105 #T1046 #T1491.001 #T1055.001 #T1070 #T1589.002 #T1036.005 #T1110 #T1547.009 #T1489 #T1110.003 #T1534 #T1047 #T1588.004 #T1104 #T1036.003 #T1591.004 #T1001.003 #T1057 #T1082 #T1561.002 #T1566.001 #T1561.001 #T1574.013 #T1573.001 #T1608.002 #T1585.002 #T1218 #T1588.002 #T1036.004 #T1204.001 #T1041 #T1560 #T1202 #T1071.001 #T1218.005 #T1059.001 #T1593.001 #T1189 #T1124 #T1056.001 #T1070.006 #T1008 #T1102.002 #T1048.003 #T1583.006 #T1221 #T1557.001 #T1098 #T1547.001 #T1567.002 #T1584.004 #T1087.002 #T1070.004 #T1560.003 #T1070.003 #T1583.004 #T1132.001 #T1588.003 #T1021.002 #T1204.002 #T1220 #T1574.002 #T1083 #T1566.002 #T1021.001 #T1021.004 #T1584.001
2020-11-16
ESET
#SupplyChain #VeraPort #MagicLine4NX #BookCodes #Lazarus #T1055 #T1587.001 #T1547.005 #T1036 #T1553.002 #T1041 #T1106 #T1588.003 #T1573.001 #T1027.002 #T1071.001 #T1584.004 #T1195.002
2020-08-18
With Secure
#Cryptocurrency #Whitepaper #YARA #Lazarus #T1059.005 #T1566.003 #T1552.001 #T1543.003 #T1027.002 #T1059.003 #T1003.001 #T1021.005 #T1070.004 #T1053.005 #T1078.002 #T1055.002 #T1070.001 #T1071.001 #T1112 #T1547.005 #T1083 #T1218.005 #T1059.001 #T1021.001
« Back