Hackers Exploit Legitimate Packer Software to Spread Malware Undetected

Threat actors are ever more abusing reputable and commercially accessible packer computer software these types of as BoxedApp to evade detection and distribute malware these as remote obtain trojans and info stealers.

“The majority of the attributed malicious samples focused monetary establishments and governing administration industries,” Check Issue security researcher Jiri Vinopal said in an examination.

The quantity of samples packed with BoxedApp and submitted to the Google-owned VirusTotal malware scanning system witnessed a spike all over Might 2023, the Israeli cybersecurity firm added, with the artifact submissions generally originating from Turkey, the U.S., Germany, France, and Russia.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Amongst the malware families distributed in this way are Agent Tesla, AsyncRAT, LockBit, LodaRAT, NanoCore, Neshta, NjRAT, Quasar RAT, Ramnit, RedLine, Remcos, RevengeRAT, XWorm, and ZXShell.

Packers are self-extracting archives that are normally made use of to bundle software and make them smaller sized. But about the yrs, this sort of equipment have been repurposed by menace actors to increase an additional layer of obfuscation to their payloads in an try to resist examination.

The spike in abuse of BoxedApp products like BoxedApp Packer and BxILMerge has been attributed to a range of gains that make it an beautiful option for attackers on the lookout to deploy malware without the need of getting detected by endpoint security program.

BoxedApp Packer can be applied to pack both of those native and .NET PEs, whereas BxILMerge – related to ILMerge – is exclusively meant for packing .NET purposes.

That explained, BoxedApp-packed purposes, like non-malicious kinds, are acknowledged to endure from a higher phony good (FP) price of detection when scanned by anti-malware engines.

“Packing the malicious payloads enabled the attackers to reduced the detection of acknowledged threats, harden their assessment, and use the advanced capabilities of BoxedApp SDK (e.g., Digital Storage) with no needing to establish them from scratch,” Vinopal explained.

“The BoxedApp SDK by itself opens a area to generate a personalized, one of a kind packer that leverages the most advanced features and is varied sufficient to steer clear of static detection.”

Malware family members like Agent Tesla, FormBook, LokiBot, Remcos, XLoader have also been propagated using an illicit packer codenamed NSIXloader that makes use of the Nullsoft Scriptable Set up Technique (NSIS). The simple fact that it can be employed to produce a various set of payloads implies it is commodified and monetized on the dark web.

“The advantage for cybercriminals in using NSIS is that it enables them to create samples that, at first look, are indistinguishable from reputable installers,” security researcher Alexey Bukhteyev explained.

“As NSIS performs compression on its possess, malware developers do not require to employ compression and decompression algorithms. The scripting abilities of NSIS make it possible for for the transfer of some malicious operation inside the script, generating the examination a lot more elaborate.”

The progress arrives as the QiAnXin XLab group uncovered aspects of a further packer codenamed Kiteshield that has been put to use by various threat actors, together with Winnti and DarkMosquito, to concentrate on Linux techniques.

“Kiteshield is a packer/protector for x86-64 ELF binaries on Linux,” XLab scientists explained. “Kiteshield wraps ELF binaries with numerous levels of encryption and injects them with loader code that decrypts, maps, and executes the packed binary completely in userspace.”

Discovered this posting appealing? Abide by us on Twitter  and LinkedIn to study extra unique material we article.