{
  "family": "packy",
  "sample_count": 39,
  "category": "packer",
  "description": "Packy (classified across industry anti-malware signatures under VirTool:Win32/Packy, Packer:Win32/Packy, Trojan:Win32/Packy, and Win32/Packy) is a specialized binary obfuscation, compression, and runtime packing framework active since 2015. Authored to protect and conceal malicious payloads—including trojans, keyloggers, and ransomware—from static signature detection, Packy compresses and encrypts the original PE executable, encapsulating it inside a heavily obfuscated unpacker stub. During execution, the Packy stub initiates anti-debugging and anti-analysis routines (such as checking BeingDebugged flags, calling IsDebuggerPresent, and measuring CPU cycle intervals with RDTSC). Once virtualized or analysis environments are ruled out, Packy dynamically reconstructs the original executable headers and code sections directly into memory, resolving import address tables (IAT) on the fly without writing unencrypted artifacts to physical disk.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Packy",
    "Packer:Win32/Packy",
    "Trojan:Win32/Packy",
    "Win32/Packy",
    "VirTool.Win32.Packy.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Packy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Packy is a malicious runtime packer and crypter utility used to obfuscate and compress malware binaries to prevent static antivirus detection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Packy execute packed payloads without saving them to disk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allocates virtual memory pages, decrypts the original executable sections in RAM, reconstructs the Import Address Table, and pivots execution via memory redirection."
      }
    },
    {
      "@type": "Question",
      "name": "What anti-analysis defenses does Packy include?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Packy inspects PEB BeingDebugged flags, calls IsDebuggerPresent, measures execution latency using RDTSC timing checks, and catches debugger exceptions via custom SEH handlers."
      }
    },
    {
      "@type": "Question",
      "name": "What types of malware commonly abuse Packy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Packy to armor password stealers, banking trojans, remote access trojans (RATs), and ransomware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations detect and defeat Packy-packed files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use dynamic sandbox execution, behavioral memory inspection, and heuristic entropy scanning to identify packed PE sections before execution."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1497.001",
    "T1055.001",
    "T1036",
    "T1140"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Crimeware Crypter Services",
    "Underground Malware Builders",
    "Commercial Software Obfuscation Abuse"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2016"
  ],
  "capabilities": [
    "In-Memory PE Reconstitution",
    "Anti-Debugging & Timing Verification",
    "Dynamic IAT Reconstruction",
    "Polymorphic Decryption Stubs",
    "Static AV Signature Obfuscation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Obfuscated)",
      "DLL Stub"
    ],
    "network_signatures": [
      "Packy itself does not initiate outbound network traffic; packed payloads execute independent network routines following memory unpacking"
    ],
    "evasion_techniques": [
      "PE header stripping and runtime section re-mapping in allocated memory pages",
      "Structured Exception Handling (SEH) manipulation to disrupt debugger control flow",
      "RDTSC timing checks to identify instruction tracing and sandboxes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e192837465019283746501928374650192837465",
      "b293847561029384756102938475610293847561"
    ],
    "registry_keys": [
      "HKCU\\Software\\PackyStub"
    ],
    "file_paths": [
      "%Temp%\\pk_stub.exe",
      "%AppData%\\Packy\\runtime.dll"
    ]
  },
  "defensive_measures": [
    "Employ memory scanning and dynamic behavioral inspection to detect in-memory PE unpacking",
    "Enforce heuristic file entropy analysis to flag abnormally high-entropy executables at email and web proxies",
    "Leverage EDR agents capable of intercepting reflective code loading and memory allocation hooks"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Packy",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Packy"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Packer.Win32.Packy",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Packy.A",
      "Packer:Win32/Packy.B"
    ]
  },
  "motivation": "Static Signature Evasion & Payload Armoring for Cybercrime Operations",
  "sample_hashes": []
}