Loading malware…
UPX is a widely used open-source executable packer and compressor rather than a malware family. It is frequently encountered in both benign software and malicious tooling because it reduces binary size and complicates static analysis until unpacked. Across intrusion reporting, UPX commonly appears as a packing layer applied to Windows DLL implants, Linux ELF payloads, Rust worms and botnet clients, Golang brute-force malware, and AutoIT backdoors. Threat actors and commodity malware operators use it as a straightforward obfuscation and defense-evasion measure, sometimes in unmodified public form and sometimes with altered headers or surrounding loaders to hinder automated unpacking. Its presence has been observed in malware associated with TeamTNT, P2PInfect, GoBruteforcer, and campaigns aligned with UAC-0057/UNC1151 and Dropping Elephant. UPX itself does not define the payload’s functionality; instead, it serves as a packing layer around other malware such as backdoors, worms, botnet components, and implants targeting Windows and Linux systems.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The decrypted payload is an ELF file packed with UPX, which is a known sample from TeamTNT, first seen in June 2020.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.
A remote, unauthenticated attacker may be able to execute arbitrary code with kernel level privileges, or create a denial-of-service condition.
Tools such as Ultimate Packer for Executables (UPX) are used to obfuscate malware
Sandworm Team used UPX to pack a copy of Mimikatz.
We fix the header and unpack: python3 -c " data = bytearray(open('crypt','rb').read()) data[5] = 0x01 open('crypt_fixed','wb').write(bytes(data)) " # Unpack with UPX upx -d crypt_fixed -o crypt_unpacked
The idea here is to stop the debugging process when the code and data are already unpacked but the unpacked code hasn’t been executed yet, to prevent the subsequent possible data and code modifications, and write down the unpacked code and data back to the disk.
Performs memory scanning of /proc/$pid/exe against signatures for known competing botnets: QBOT/Bashlite variants... UPX-packed binaries... Zollard worm... Remaiten...
The idea here is to stop the debugging process when the code and data are already unpacked but the unpacked code hasn’t been executed yet, to prevent the subsequent possible data and code modifications, and write down the unpacked code and data back to the disk.
A remote, unauthenticated attacker may be able to execute arbitrary code with kernel level privileges, or create a denial-of-service condition.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.