Technique:  Obfuscated Files or Information:Software Packing
During the 2016 Ukraine Electric Power Attack, It used UPX to pack a copy of Mimikatz.
Anchor has come with a packed payload.
It has used the Themida packer to obfuscate malicious payloads.
AppleSeed has used UPX packers for its payload DLL.
It used UPX to pack files.
It has been known to pack their tools.
It has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.
It has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.
Astaroth uses a software packer called Pe123\RPolyCryptor.
Versions of Babuk have been packed.
Bazar has a variant with a packed payload.
Bisonal has used the MPRESS packer and similar tools for obfuscation.
BLINDINGCAN has been packed with the UPX packer.
During C0017, It used VMProtect to slow the reverse engineering of malicious binaries.
China Chopper's client component is packed with UPX.
Clop has been packed to help avoid detection.
CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.
CSPY Downloader has been packed with UPX.
Cuba has a packed payload when delivered.
It has used UPX to pack Bandook.
DarkComet has the option to compress its payload using UPX or MPRESS.
A version of Daserf uses the MPRESS packer.
Dok is packed with an UPX executable packer.
Donut can generate packed code modules.
DRATzarus's dropper can be packed with UPX.
Dyre has been delivered with encrypted resources and must be unpacked for execution.
Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.
It has packed malware payloads before delivery to victims.
It has packed malware to help avoid detection.
Emotet has used custom packers to protect its payloads.
FatDuke has been regularly repacked by its operators to create large binaries and evade detection.
A FinFisher variant uses a custom packer.
FYAnti has used ConfuserEx to pack its .NET module.
It packed some payloads using different types of packers, both known and custom.
GoldMax has been packed for obfuscation.
GreyEnergy is packed for obfuscation.
H1N1 uses a custom packing algorithm.
Hildegard has packed ELF files into other binaries.
HotCroissant has used the open source UPX executable packer.
HyperBro has the ability to pack its payload.
IcedID has packed and encrypted its loader module.
jRAT payloads have been packed.
It has packed malware with UPX.
KONNI has been packed for obfuscation.
LiteDuke has been packed with multiple layers of encryption.
Lokibot has used several packing methods for obfuscation.
Lucifer has used UPX packed binaries.
It has been packed with NSIS.
Melcoz has been packed with VMProtect and Themida.
Metamorfo has used VMProtect to pack and protect files.
Misdat was typically packed using UPX.
Mongall has been packed with Themida.
It has used malware plugins packed with Themida.
NETWIRE has used .NET packer tools to evade detection.
During Night Dragon, threat actors used software packing in its tools.
OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.
During Operation Dream Job, It packed malicious .db files with Themida to evade detection.
For Operation Dust Storm, the threat actors used UPX to pack some payloads.
For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.
OSX_OCEANLOTUS.D has a variant that is packed with UPX.
A It payload was packed with UPX.
QakBot can encrypt and pack malicious payloads.
Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.
It's miner has created UPX-packed files in the Windows Start Menu Folder.
Some S-Type samples have been packed with UPX.
Saint Bot has been packed using a dark market crypter.
SDBbot has used a packed installer file.
SeaDuke has been packed with the UPX packer.
ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.
Spark has been packed with Enigma Protector to obfuscate its contents.
Squirrelwaffle has been packed with a custom packer to hide payloads.
SysUpdate has been packed with VMProtect.
It has used a .NET packer to obfuscate malicious files.
It has used UPX to obscure malicious code.
It has used UPX and Ezuri packer to pack its binaries.
It has obfuscated their payloads through packing.
It has packed malware and tools, including using VMProtect.
Tomiris has been packed with UPX.
Torisma has been packed with Iz4 compression.
TrickBot leverages a custom packer to obfuscate its functionality.
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.
Uroburos uses a custom packer.
Valak has used packed DLL payloads.
VERMIN is initially packed.
yty packs a plugin with UPX.
Zebrocy's Delphi variant was packed with UPX.
Some ZeroT DLL files have been packed with UPX.
ItM has used multi-stage packers for exploit code.