{
  "family": "obsidium",
  "sample_count": 57,
  "category": "packer",
  "description": "Obsidium (cataloged across security vendors and binary analysis platforms under signatures including Packer:Win32/Obsidium, Trojan:Win32/Obsidium, and Trojan-Ransom.Win32.Obsidium) represents malicious binaries packaged and obfuscated using the commercial Obsidium software protector. While Obsidium was originally engineered as legitimate intellectual property and licensing protection software, threat actors, trojan distributors, and ransomware syndicates systematically weaponize its advanced anti-reverse-engineering capabilities to shield malicious payloads from static and heuristic antivirus scanners. Executables packed with Obsidium feature sophisticated virtual machine (VM) code virtualization that translates native x86/x64 instructions into proprietary, randomized bytecode interpreted at runtime. The protector incorporates aggressive anti-debugging checks (monitoring the Process Environment Block BeingDebugged flag and NtQueryInformationProcess), hardware breakpoint detection, RDTSC timing discrepancy analysis, memory integrity checksumming, and polymorphic entry-point stubs to confound automated sandbox analysis.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Packer:Win32/Obsidium",
    "Trojan:Win32/Obsidium",
    "Trojan-Ransom.Win32.Obsidium",
    "Packer.Obsidium",
    "Win32/Obsidium"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Packer:Win32/Obsidium?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Obsidium is a commercial binary protector and packer frequently abused by malware authors to hide malicious code."
      }
    },
    {
      "@type": "Question",
      "name": "Why do malware developers use Obsidium to pack payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides code virtualization, polymorphic encryption, and aggressive anti-debugging that defeats security scanners."
      }
    },
    {
      "@type": "Question",
      "name": "How does Obsidium evade sandbox analysis environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks CPU execution timing via RDTSC instructions and scans memory for known analysis tools and hypervisors."
      }
    },
    {
      "@type": "Question",
      "name": "What types of malware are commonly packed using Obsidium?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ransomware strains, remote access trojans (RATs), credential stealers, and banking malware."
      }
    },
    {
      "@type": "Question",
      "name": "How do security analysts unpack Obsidium-protected binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through dynamic memory dumping after payload decompression and using debugger plugins that hide analysis flags."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1497.001",
    "T1622",
    "T1055",
    "T1140",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately if the Obsidium executable was allowed to run; the highly obfuscated nature implies a severe, targeted payload.",
    "If the process is active, capture a live memory image (RAM dump) before rebooting to attempt extraction of the decrypted payload.",
    "Submit the packed binary to a specialized malware analyst for reverse engineering, noting that unpacking Obsidium is a highly specialized skill.",
    "Perform a full forensic sweep to determine how the highly obfuscated executable arrived on the endpoint."
  ],
  "what_to_avoid": [
    "Do not waste time trying to statically analyze the Obsidium executable on disk; the strong encryption will yield zero actionable intelligence.",
    "Avoid assuming the threat was fully blocked simply because AV flagged the file; the payload may have already executed in memory."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Evasion & Software Protection",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Weaponized Software Cracks & Keygens",
    "Trojanized Installers",
    "Exploit Kit Payloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Virtual Machine Code Virtualization",
    "Anti-Debugging & Anti-Analysis",
    "Polymorphic Entry Point Decryption",
    "Hardware Breakpoint Detection",
    "Memory Checksum Integrity Verification"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Network activity determined by the unpacked underlying payload (infostealer C2, ransomware beaconing)"
    ],
    "evasion_techniques": [
      "Proprietary virtual machine instruction interpreter",
      "PEB BeingDebugged and NtGlobalFlag inspection",
      "RDTSC execution timing delta measurements to detect single-stepping"
    ],
    "indicators": {
      "file_paths": [
        "%Temp%\\obs_unpacked.tmp"
      ],
      "registry_keys": []
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Obsidium Software Protection"
    ],
    "variants": [
      "Obsidium-Packed-RAT",
      "Obsidium-Ransomware"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e5f67890123456789abcdef0123456789abcdef0123456789abcdef012345678",
      "f67890123456789abcdef0123456789abcdef0123456789abcdef0123456789"
    ],
    "delivery": [
      "keygen_activator_setup.exe",
      "cracked_utility_installer.exe"
    ],
    "persistence": []
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Packer:Win32/Obsidium",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Packer:Win32/Obsidium"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Obsidium",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Obsidium/"
    }
  ]
}