{
  "family": "multipacked",
  "sample_count": 36,
  "category": "packer",
  "description": "MultiPacked (cataloged across security vendors and intelligence telemetry as VirTool:Win32/MultiPacked, Packer:Win32/MultiPacked, and Trojan.Win32.MultiPacked) designates executable payloads that have been subjected to multi-layered, nested runtime packing schemes. Cybercriminal operators utilize MultiPacked techniques to defeat automated sandbox unpackers and static heuristic detection by encapsulating an already packed executable within one or more additional layers of external crypters or commercial virtualization software (such as combining UPX with VMProtect, Themida, or custom XOR-based decrypters). When executed, the binary unpacks sequentially in memory: the outer stub decrypts an intermediary decompression loader, which in turn conducts anti-debugging and environment checks before peeling away the inner layer and executing the underlying malicious payload.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/MultiPacked",
    "Packer:Win32/MultiPacked",
    "Trojan.Win32.MultiPacked",
    "Win32/MultiPacked",
    "MultiPacked.Gen"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What does the VirTool:Win32/MultiPacked detection mean?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MultiPacked identifies executables that use multiple nested layers of packers and encryption stubs to prevent static analysis and reverse engineering."
      }
    },
    {
      "@type": "Question",
      "name": "Why do malware authors use nested packing?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nested packing defeats single-layer automated unpacking routines in antivirus sandboxes, requiring multiple execution phases to reveal the actual payload."
      }
    },
    {
      "@type": "Question",
      "name": "What commercial and custom packers are commonly combined?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors frequently wrap payloads in UPX, then armor them with software protection tools like Themida, VMProtect, or proprietary underground crypters."
      }
    },
    {
      "@type": "Question",
      "name": "How does MultiPacked evade dynamic sandbox analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Each unpacking layer incorporates separate anti-debugging, timing, and hypervisor detection routines, aborting execution if any layer detects analysis."
      }
    },
    {
      "@type": "Question",
      "name": "How can security analysts de-obfuscate MultiPacked malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By placing memory breakpoints on API calls like VirtualAlloc and WriteProcessMemory, following the unpacking cascade, and dumping the final payload at OEP (Original Entry Point)."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1140",
    "T1497.001",
    "T1055",
    "T1036"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Underground Crypting Services",
    "Phishing Weaponization Pipelines",
    "Exploit Kit Payload Deliveries"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2019"
  ],
  "capabilities": [
    "Nested Multi-Stage Memory Unpacking",
    "Layered Anti-Debugging Routines",
    "Cascading Decryption Key Derivation",
    "Virtual Machine Detection at Multiple Stages",
    "Dynamic API Reconstruction"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Nested Packing)",
      "64-bit PE Executable"
    ],
    "network_signatures": [
      "MultiPacked files do not generate native network traffic until all unpacking stages are concluded and the core malware payload initializes its C2 client"
    ],
    "evasion_techniques": [
      "Recursive section encryption requiring multiple distinct execution iterations to expose payload opcodes",
      "Interspersed hardware breakpoint checks and INT 3 traps between decryption layers",
      "Manipulating section header flags to make code sections appear as unmapped data"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f5061728394a5b6c7d8e9f0123456789abcdef01",
      "061728394a5b6c7d8e9f0123456789abcdef0123"
    ],
    "registry_keys": [
      "HKCU\\Software\\MultiPackedStub"
    ],
    "file_paths": [
      "%Temp%\\layer1_stub.tmp",
      "%AppData%\\MultiPacked\\runtime.bin"
    ]
  },
  "defensive_measures": [
    "Deploy memory introspection tools capable of monitoring process memory after multiple unpacking stages",
    "Flag executables exhibiting abnormally abnormal section counts and nested entropy spikes at mail gateways",
    "Utilize automated emulation sandboxes configured with extended execution runtimes to allow full unpacking"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/MultiPacked",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/MultiPacked"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Packer.Win32.MultiPacked",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/MultiPacked.A",
      "Packer:Win32/MultiPacked.B"
    ]
  },
  "motivation": "Multi-Tier Static & Dynamic Antivirus Evasion",
  "sample_hashes": []
}