Description
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)
Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)
Platforms
Mitigations (1)
Antivirus/AntimalwareM1049
Employ heuristic-based malware detection. Ensure updated virus definitions and create custom signatures for observed malware.
Threat Groups (23)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their i... |
| G0066 | Elderwood | [Elderwood](https://attack.mitre.org/groups/G0066) has packed malware payloads before delivery to victims.(Citation: Symantec Elderwood Sept 2012) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) packed some payloads using different types of packers, both known and custom.(Citation: Cybereason So... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has been known to pack their tools.(Citation: APT3 Adversary Emulation Plan)(Citation: FireEye Clandesti... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has packed malware with UPX.(Citation: Malwarebytes Kimsuky June 2021) |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files Brightmetr... |
| G0040 | Patchwork | A [Patchwork](https://attack.mitre.org/groups/G0040) payload was packed with UPX.(Citation: Securelist Dropping Elephant) |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) uses packers such as Themida to obfuscate malicious files.(Citation: Rostovcev APT41 2021) |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used UPX and Ezuri packer to pack its binaries.(Citation: Trend Micro TeamTNT) |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used multi-stage packers for exploit code.(Citation: Check Point APT31 February 2021) |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106)'s miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 201... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has packed tools with UPX, and has repacked a modified version of [Mimikatz](https://attack.mitre.org/s... |
| G1018 | TA2541 | [TA2541](https://attack.mitre.org/groups/G1018) has used a .NET packer to obfuscate malicious files.(Citation: Cisco Operation Layover September 2021) |
| G1007 | Aoqin Dragon | [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has used the Themida packer to obfuscate malicious payloads.(Citation: SentinelOne Aoqin Dragon ... |
| G0089 | The White Company | [The White Company](https://attack.mitre.org/groups/G0089) has obfuscated their payloads through packing.(Citation: Cylance Shaheen Nov 2018) |
| G1031 | Saint Bear | [Saint Bear](https://attack.mitre.org/groups/G1031) clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from ... |
| G1019 | MoustachedBouncer | [MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used malware plugins packed with Themida.(Citation: MoustachedBouncer ESET August 2023) |
| G1053 | Storm-0501 | [Storm-0501](https://attack.mitre.org/groups/G1053) has used Themida to pack [Cobalt Strike](https://attack.mitre.org/software/S0154) payloads.(Citati... |
| G0092 | TA505 | [TA505](https://attack.mitre.org/groups/G0092) has used UPX to obscure malicious code.(Citation: IBM TA505 April 2020) |
| G0016 | APT29 | [APT29](https://attack.mitre.org/groups/G0016) used UPX to pack files.(Citation: Mandiant No Easy Breach) |
Associated Software (73)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) leverages a custom packer to obfuscate its functionality.(Citation: S2 Grupo TrickBot June 2017) |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has been packed with the UPX packer.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has been packed with Enigma Protector to obfuscate its contents.(Citation: Unit42 Molerat Mar 2020) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) has been packed with Iz4 compression.(Citation: McAfee Lazarus Nov 2020) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) packs a plugin with UPX.(Citation: ASERT Donot March 2018) |
| S1105 | COATHANGER | Malware | The first stage of [COATHANGER](https://attack.mitre.org/software/S1105) is delivered as a packed file.(Citation: NCSC-NL COATHANGER Feb 2024) |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) was typically packed using UPX.(Citation: Cylance Dust Storm) |
| S9018 | HeartCrypt | Malware | [HeartCrypt](https://attack.mitre.org/software/S9018) can pack malicious Windows x86 and .NET payloads in order to evade detection.(Citation: Palo Alt... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has used UPX packers for its payload DLL.(Citation: Malwarebytes Kimsuky June 2021) |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has used .NET packer tools to evade detection.(Citation: Red Canary NETWIRE January 2020) |
| S0342 | GreyEnergy | Malware | [GreyEnergy](https://attack.mitre.org/software/S0342) is packed for obfuscation.(Citation: ESET GreyEnergy Oct 2018) |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has used custom packers to protect its payloads.(Citation: Trend Micro Emotet Jan 2019) |
| S0671 | Tomiris | Malware | [Tomiris](https://attack.mitre.org/software/S0671) has been packed with UPX.(Citation: Kaspersky Tomiris Sep 2021) |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) has been packed with NSIS.(Citation: ESET Machete July 2019) |
| S1030 | Squirrelwaffle | Malware | [Squirrelwaffle](https://attack.mitre.org/software/S1030) has been packed with a custom packer to hide payloads.(Citation: ZScaler Squirrelwaffle Sep ... |
| S0601 | Hildegard | Malware | [Hildegard](https://attack.mitre.org/software/S0601) has packed ELF files into other binaries.(Citation: Unit 42 Hildegard Malware) |
| S0628 | FYAnti | Malware | [FYAnti](https://attack.mitre.org/software/S0628) has used ConfuserEx to pack its .NET module.(Citation: Securelist APT10 March 2021) |
| S0230 | ZeroT | Malware | Some [ZeroT](https://attack.mitre.org/software/S0230) DLL files have been packed with UPX.(Citation: Proofpoint ZeroT Feb 2017) |
| S1130 | Raspberry Robin | Malware | [Raspberry Robin](https://attack.mitre.org/software/S1130) contains multiple payloads that are packed for defense evasion purposes and unpacked on run... |
| S0565 | Raindrop | Malware | [Raindrop](https://attack.mitre.org/software/S0565) used a custom packer for its [Cobalt Strike](https://attack.mitre.org/software/S0154) payload, whi... |
References
- Alexandre D'Hondt. (n.d.). Awesome Executable Packing. Retrieved March 11, 2022.
- Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.
Frequently Asked Questions
What is T1027.002 (Software Packing)?
T1027.002 is a MITRE ATT&CK technique named 'Software Packing'. It belongs to the Stealth tactic(s). Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable ch...
How can T1027.002 be detected?
Detection of T1027.002 (Software Packing) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1027.002?
There are 1 documented mitigations for T1027.002. Key mitigations include: Antivirus/Antimalware.
Which threat groups use T1027.002?
Known threat groups using T1027.002 include: APT38, Elderwood, GALLIUM, APT3, Kimsuky, Volt Typhoon, Patchwork, APT41.