A packed program arrives looking like noise and turns into code only after it starts running. That is the whole point: whatever scanned the file saw the wrapper, not the contents.
MITRE tracks this as Software Packing, technique T1027.002, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Software packing is a method of compressing or encrypting an executable. Doing so changes the file signature, which is how it avoids signature based detection. Most decompression techniques unpack the real code in memory.
MITRE also describes virtual machine software protection. The original code is translated into a special format that only a bundled virtual machine can run, so even the code in memory does not look like normal machine code.
The tools that do this are called packers. MITRE gives MPRESS and UPX as examples and notes a longer list of known packers exists. It adds that adversaries may build their own, which leave none of the usual artifacts.
How to detect it
MITRE's strategy (DET0023) looks at behavior rather than the file:
- Windows. Abnormal memory allocation, followed by injection of executable code and execution from non-image sections.
- Linux. Execution of an ELF file with high entropy writable memory segments and self-modifying code patterns.
- macOS. Packed Mach-O binaries that unpack into memory and then pass control to dynamically modified code.
Static clues help as well: high entropy sections, very few imports, and sections that are both writable and executable. None is proof on its own.
How to reduce the risk
MITRE lists one mitigation: antivirus and antimalware. Use heuristic based malware detection, keep definitions updated and create custom signatures for malware you have observed.
Beyond that, application control that blocks unknown executables limits what a packed binary can do before anyone examines it.
Quick check
Why does packing defeat signature based detection?
Packing compresses or encrypts the executable, which changes the file signature. The original code only appears in memory after the program runs.
Sources
- MITRE ATT&CK, Software Packing (T1027.002)
