Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.1 Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.2
- ESET FinFisher Jan 2018
- Awesome Executable Packing
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g1007 | Aoqin Dragon | China |
| grp_g1018 | TA2541 | — |
| grp_g0070 | Dark Caracal | — |
| grp_g1031 | Saint Bear | Russia |
| grp_g0128 | ZIRCONIUM | — |
| grp_g0089 | The White Company | — |
| grp_g0093 | GALLIUM | — |
| grp_g0066 | Elderwood | China |
| grp_g1051 | Medusa Group | — |
| grp_g1019 | MoustachedBouncer | — |
| grp_g1053 | Storm-0501 | — |
| grp_g1058 | The Gentlemen | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0087 | APT39 | — |
| grp_g0022 | APT3 | China |
| grp_g0092 | TA505 | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0139 | TeamTNT | — |
| grp_g0096 | APT41 | China |
| grp_g0106 | Rocke | — |
| grp_g0016 | APT29 | Russia |
| grp_g0040 | Patchwork | — |
| grp_g0027 | Threat Group-3390 | China |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。