T1027.002: Obfuscated Files or Information: Software Packing
Operational Executive Summary
T1027.002 (Obfuscated Files or Information: Software Packing) is classified under the Defense Evasion tactic within the MITRE ATT&CK framework. Tradecraft designed to avoid detection, analysis, and eradication throughout their operational lifecycle, including process injection, file obfuscation, and disabling defensive telemetry. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 108 distinct malware families, totaling over 14,018 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Obfuscated Files or Information: Software Packing to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Obfuscated Files or Information: Software Packing, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1027.002 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Obfuscated Files or Information: Software Packing to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1027/002/.
Detection Engineering & Threat Hunting
Detecting Obfuscated Files or Information: Software Packing requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1027.002 (Obfuscated Files or Information: Software Packing) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Obfuscated Files or Information: Software Packing across adjacent network segments.
Cataloged Malware Families Utilizing T1027.002 (108 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1027.002 (Obfuscated Files or Information: Software Packing):
108 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| flystudio | Packer | 4,527 | FlyStudio (identified across enterprise antivirus detection signatures as Packer:Win32/FlyStudio, Trojan:Win32/FlyStudio, and Trojan.MalPack.FlyStudio) is a wid... |
| prepscram | Pua | 3,130 | SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepscram) is a prolific soft... |
| autoit | Packer | 1,895 | AutoIt (classified across commercial antivirus vendors as Trojan:Win32/AutoIt, Packer:Win32/AutoIt, and Backdoor.AutoIt) is a widely abused legitimate freeware ... |
| scar | Trojan | 984 | Trojan:Win32/Scar (cataloged across security telemetry as Trojan.Win32.Scar, Win32/Scar, or Downloader.Scar) is an obfuscated Windows trojan downloader and spyw... |
| msilperseus | Infostealer | 596 | MSIL/Perseus (identified in endpoint telemetry as Trojan:MSIL/Perseus, Trojan.MSIL.Perseus, and MSIL/Perseus.A) is a modular .NET-based information stealer and ... |
| vbkryjetor | Packer | 551 | Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual... |
| fsysna | Trojan | 427 | Trojan:Win32/Fsysna (documented across vendor telemetry as Trojan.Win32.Fsysna, Win32/Fsysna, or Trojan.Win32.FSYSNA) is a sophisticated multi-stage trojan load... |
| genkryptik | Packer | 353 | GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software ... |
| reconyc | Downloader | 222 | Reconyc (cataloged across security software as Trojan:Win32/Reconyc, Trojan.Win32.Reconyc, and Trojan.Reconyc) is a heavily obfuscated Windows trojan dropper an... |
| parite | File Infector | 163 | Parite (tracked across cybersecurity vendor signatures as Virus:Win32/Parite.B, Virus.Win32.Parite.b, Pinfi, PE_PARITE.A, and W32.Pinite) is an infamous, highly... |
| beebone | Worm | 151 | Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified i... |
| noobyprotect | Packer | 136 | Noobyprotect (cataloged in threat telemetry under signatures including SoftwareBundler:Win32/Noobyprotect, Trojan.MalPack.NP, and PUA:Win32/NoobyProtect) is a c... |
| confuser | Packer | 120 | Confuser (and its prominent open-source successor, ConfuserEx, cataloged by security vendors as HackTool:MSIL/Confuser, VirTool:MSIL/Obfuscator, and Trojan:MSIL... |
| dynamer | Trojan | 110 | Dynamer (cataloged across security telemetry as Trojan:Win32/Dynamer, Trojan:Win32/Dynamer!ac, Trojan:Win32/Dynamer!rfn, and Trojan.Win32.Dynamer) is a prevalen... |
| addrop | Adware | 103 | Addrop (cataloged across security vendors as Adware:Win32/Addrop, Adware.Addrop, and PUA:Win32/Addrop) is a persistent adware dropper and Potentially Unwanted A... |
| vmprotbad | Trojan | 87 | VMProtBad (cataloged across security vendors under detections including Trojan:Win32/VMProtBad, Trojan:Win32/VMProtect, and Win32/VMProtBad) is a heuristic thre... |
| pynamer | Trojan | 67 | Pynamer (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Pynamer, Trojan.Pynamer, and Trojan:Win32/P... |
| obsidium | Packer | 57 | Obsidium (cataloged across security vendors and binary analysis platforms under signatures including Packer:Win32/Obsidium, Trojan:Win32/Obsidium, and Trojan-Ra... |
| enigmaprotector | Packer | 50 | EnigmaProtector (cataloged across security vendors and threat intelligence databases under detections including Packer:Win32/EnigmaProtector, Trojan:Win32/Enigm... |
| celesty | Trojan | 34 | Celesty (often referenced as Celesty Binder or Celesty RAT) is a malicious utility designed to bundle multiple executable files together and facilitate remote b... |
| multidropper | Trojan Dropper | 17 | MultiDropper (tracked across industry threat intelligence platforms as TrojanDropper:Win32/MultiDropper, Dropper.Win32.Multi, and Trojan.MultiDropper) is an int... |
| cryptinject | Ransomware | 15 | Cryptinject (classified in antimalware definitions under designations including Ransom:Win32/Cryptinject, Trojan:Win32/Cryptinject, and VirTool:Win32/Cryptinjec... |
| enigma | Ransomware | 14 | Enigma (classified as Ransom:Win32/Enigma and Trojan-Ransom.Win32.Enigma) is an advanced Windows crypto-ransomware family designed for rapid and devastating cor... |
| vmpbad | Ransomware | 14 | Vmpbad (classified across antimalware research as Trojan:Win32/Vmpbad and Ransom:Win32/Vmpbad) is a heavily packed and armored trojan loader and crypto-ransomwa... |
| banpak | Trojan | 12 | Banpak (classified in antivirus detection telemetry under designations including Trojan:Win32/Banpak, Trojan.Win32.Banpak, and Win32/Banpak) is a multi-stage tr... |
| exescript | Ransomware | 12 | HackTool:Win32/Exescript (or similar detections) often refers to utilities designed to compile standard scripts (like VBScript, Batch, or PowerShell) into stand... |
| autit | Trojan | 11 | Autit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autit, Trojan.Win32.Autit, and Win32/Autit) is a multi-stage trojan... |
| malwarecrypter | Ransomware | 10 | Trojan:Win32/Malwarecrypter is a generic, heuristic detection name used by endpoint security solutions to flag executable files that have been obfuscated using ... |
| moleboxvs | Trojan | 10 | HackTool:Win32/Moleboxvs (or simply **Molebox**) is a heuristic detection for executable files that have been packed, encrypted, or virtualized using the 'Moleb... |
| pespin | Ransomware | 8 | Trojan:Win32/Pespin (or generic **Pespin Packer** heuristics) refers to detections associated with the 'PESpin' executable packer and protector. Originally desi... |
| morphine | Ransomware | 7 | Packer:Win32/Morphine is a highly notorious heuristic detection for a specific type of **Polymorphic Packer** and crypter. Morphine is not malware itself; it is... |
| eziriznetreactor | Ransomware | 5 | HackTool:MSIL/Eziriznetreactor (often detected as a generic Suspicious or PUA file) refers to the malicious abuse of the legitimate **Eziriz .NET Reactor** soft... |
| genericrxen | Ransomware | 5 | Trojan:Win32/Genericrxen is a broad, heuristic detection name used by Microsoft Defender and other antivirus engines to classify a wide variety of trojans that ... |
| msildrop | Ransomware | 5 | TrojanDropper:Win32/Msildrop (or Generic MSIL Dropper) is a broad heuristic classification for malicious software written in C# or VB.NET and compiled into Micr... |
| vbinder | Trojan | 5 | Trojan:Win32/Vbinder (often classified generically as a 'Binder', 'Joiner', or 'Wrapper') is not a specific malware payload itself, but rather a malicious utili... |
| armadillo | Ransomware | 4 | Armadillo (classified in antivirus detection telemetry under designations including Ransom:Win32/Armadillo, Ransom.Win32.Armadillo, and Win32/Armadillo) is a cr... |
| ponmocup | Trojan | 4 | Trojan:Win32/Ponmocup (also known as Vundo or Virtumonde) is one of the most sophisticated, longest-running, and massive botnets in history. Active for over a d... |
| genericrxev | Ransomware | 3 | Trojan:Win32/Genericrxev is a generic, heuristic detection applied by Microsoft Defender to binaries exhibiting a broad range of malicious behaviors, primarily ... |
| genericrxgl | Ransomware | 3 | Trojan:Win32/Genericrxgl is a generic, heuristic detection applied by Microsoft Defender to binaries exhibiting a broad range of malicious behaviors, primarily ... |
| installmate | Trojan | 3 | Adware:Win32/Installmate is a detection for a potentially malicious software packager or bundler. InstallMate itself (formerly Tarma InstallMate) is a legitimat... |
| netshrink | Ransomware | 3 | HackTool:Win32/Netshrink is a detection for an executable compressor (packer) designed specifically for .NET applications. While technically a legitimate tool f... |
| smartassembly | Ransomware | 3 | HackTool:Win32/Smartassembly is a highly nuanced detection. SmartAssembly itself is a **legitimate commercial software obfuscator and protector** created by Red... |
| unpacked | Ransomware | 3 | Trojan:Win32/Unpacked is a critical **Heuristic Detection** flagged by modern endpoint security solutions. It is not a specific malware family, but rather a beh... |
| vbcryptor | Ransomware | 3 | Ransomware:Win32/Vbcryptor is a broad detection name applied to various strains of ransomware, file encoders, and malicious crypters that are compiled using Mic... |
| cryptexe | Ransomware | 2 | Trojan:Win32/Cryptexe is a generic detection frequently applied to malware that utilizes sophisticated software packing, encryption, or obfuscation tools ('cryp... |
| cryptpack | Ransomware | 2 | Riskware:Win32/Cryptpack is a broad heuristic detection used by antivirus engines to identify files that have been obfuscated, compressed, or encrypted using kn... |
| genericrxeo | Ransomware | 2 | Trojan:Win32/Genericrxeo (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| genericrxep | Ransomware | 2 | Trojan:Win32/Genericrxep (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| genericrxer | Ransomware | 2 | Trojan:Win32/Genericrxer (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| genericrxew | Ransomware | 2 | Trojan:Win32/Genericrxew (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| genericrxgb | Ransomware | 2 | Trojan:Win32/Genericrxgb (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| genericrxgf | Ransomware | 2 | Trojan:Win32/Genericrxgf (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signa... |
| launcher | Ransomware | 2 | Trojan:Win32/Launcher is a generic classification for a critical architectural component of modern malware: the initial execution stub. A 'Launcher' (or Dropper... |
| manuscrypt | Trojan | 2 | Trojan:Win32/Manuscrypt (also known as Volgmer or FALLCHILL) is an extremely sophisticated malware family strongly associated with the North Korean state-sponso... |
| msilinj | Trojan | 2 | Trojan:MSIL/Msilinj (often denoting a Microsoft Intermediate Language Injector) is a specific detection for a loader or 'crypter' written in the .NET framework ... |
| npack | Advanced Threat | 2 | Behavior:Win32/Npack is a generic heuristic detection that flags executables utilizing custom, unknown, or highly suspicious software packers (`T1027.002`). Whi... |
| winload | Ransomware | 2 | Trojan:Win32/Winload is a classification for trojans specifically designed to act as 'Loaders' or 'Droppers'. Its sole purpose is to securely download, decrypt,... |
| adcrypterlib | Ransomware | 1 | Adcrypterlib (classified in antivirus detection telemetry under designations including Ransom:Win32/Adcrypterlib, Ransom.Win32.Adcrypterlib, and Win32/Adcrypter... |
| bmgfrznl2gfaa | Ransomware | 1 | Bmgfrznl2Gfaa (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmgfrznl2Gfaa, Ransom.Win32.Bmgfrznl2Gfaa, and Win32/Bmgfrz... |
| bmsdus4ufhei | Ransomware | 1 | Bmsdus4Ufhei (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmsdus4Ufhei, Ransom.Win32.Bmsdus4Ufhei, and Win32/Bmsdus4Uf... |
| cmhfbw9r | Ransomware | 1 | <h3>Executive Summary</h3> "Cmhfbw9r" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like naming con... |
| dnguard | Ransomware | 1 | HackTool:Win32/Dnguard represents the malicious abuse of 'DNGuard HVM', a commercial, legitimate obfuscator and code protector for .NET applications. While soft... |
| encryptpe | Ransomware | 1 | <h3>Executive Summary</h3> EncryptPE is not inherently a malware family; rather, it is a legitimate commercial software protector and executable packer. However... |
| exebinder | Trojan | 1 | <h3>Executive Summary</h3> ExeBinder (often detected generically as HackTool:Win32/ExeBinder or Binder) refers to a classification of utility programs heavily u... |
| fakecoder | Ransomware | 1 | Trojan:Win32/Fakecoder is a classic but enduring social engineering lure designed to trick users into executing malware under the guise of a required media play... |
| fmgfagns0sge | Ransomware | 1 | <h3>Executive Summary</h3> "fmgfagns0sge" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| genericrxax | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxax" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strong... |
| genericrxbu | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxbu" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strong... |
| genericrxbz | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxbz" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strong... |
| genericrxel | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxel" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strong... |
| genericrxgk | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxgk" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strong... |
| geni | Ransomware | 1 | Trojan:Win32/Geni (often a truncation of 'Generic') signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because... |
| hg8absxocmcj | Ransomware | 1 | <h3>Executive Summary</h3> "hg8absxocmcj" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| kgen | Ransomware | 1 | HackTool:Win32/Kgen (Keygen) designates software crack utilities, key generators, and software patchers. While originally designed solely to bypass software lic... |
| kjwar5ju8ibgb | Trojan | 1 | <h3>Executive Summary</h3> "Kjwar5ju8ibgb" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Doma... |
| kmuaaovs | Ransomware | 1 | <h3>Executive Summary</h3> "Kmuaaovs" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which ap... |
| kryptpck | Ransomware | 1 | <h3>Executive Summary</h3> Kryptpck (often a variant identifier for Cryptolocker-style ransomware or generic heavily packed ransomware) is a highly destructive ... |
| lixeaqbyzsj | Ransomware | 1 | <h3>Executive Summary</h3> "lixeaqbyzsj" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which... |
| magic | Ransomware | 1 | HackTool:Win32/Magic is a broad categorization for utilities designed to modify, patch, or crack legitimate software, often to bypass DRM or licensing checks. W... |
| mmnfbgfpueki | Trojan | 1 | <h3>Executive Summary</h3> "Mmnfbgfpueki" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| molebox | Advanced Threat | 1 | <h3>Executive Summary</h3> Molebox is a dual-use technology. Originally developed as a legitimate commercial software virtualization and packing utility (design... |
| moleboxultra | Ransomware | 1 | HackTool:Win32/Moleboxultra refers to the detection of a specific commercial software protector and packer, known as MoleBox, which is frequently abused by malw... |
| msilpack | Advanced Threat | 1 | <h3>Executive Summary</h3> MSILPack (or MSIL/Packer) is a heuristic detection identifying a malicious file that has been wrapped, obfuscated, or compiled using ... |
| mz0a4gxuisb | Trojan | 1 | <h3>Executive Summary</h3> "Mz0a4gxuisb" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain... |
| nmkfacwya3cg | Ransomware | 1 | <h3>Executive Summary</h3> "nmkfacwya3cg" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| noupack | Ransomware | 1 | <h3>Executive Summary</h3> Noupack is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor ... |
| omgfamcremci | Ransomware | 1 | <h3>Executive Summary</h3> "Omgfamcremci" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| pckdflystudio | Ransomware | 1 | <h3>Executive Summary</h3> Pckdflystudio is a heuristic detection name indicating that an executable file has been compressed or obfuscated using FlyStudio, a k... |
| pef13c | Ransomware | 1 | <h3>Executive Summary</h3> "Pef13c" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly su... |
| pyspy | Trojan | 1 | TrojanSpy:Python/Pyspy represents a growing trend in malware development: threats written entirely in the Python programming language. Attackers leverage Python... |
| rmkefdlslaoi | Ransomware | 1 | <h3>Executive Summary</h3> "Rmkefdlslaoi" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| rz0auircb0di | Trojan | 1 | <h3>Executive Summary</h3> "Rz0auircb0di" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| scramupx | Advanced Threat | 1 | <h3>Executive Summary</h3> ScramUPX is a highly specialized malware packing and obfuscation utility. It is designed to take an executable file that has already ... |
| uiwao0sam | Trojan | 1 | <h3>Executive Summary</h3> "Uiwao0sam" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain G... |
| uiwaowr6xsaje | Ransomware | 1 | <h3>Executive Summary</h3> "Uiwaowr6xsaje" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Doma... |
| umgfxgkazyg | Ransomware | 1 | <h3>Executive Summary</h3> "umgfxgkazyg" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which... |
| umqabaxnjogc | Ransomware | 1 | <h3>Executive Summary</h3> "umqabaxnjogc" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| upackdam | Ransomware | 1 | <h3>Executive Summary</h3> Upackdam (or Upack) is a classification for a specific, aggressive executable packer/compressor used almost exclusively by malware de... |
| vmjfbex4hpjj | Ransomware | 1 | <h3>Executive Summary</h3> "vmjfbex4hpjj" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| werpoapt | Backdoor | 1 | <h3>Executive Summary</h3> WerpoAPT is a sophisticated Advanced Persistent Threat (APT) group and associated malware framework characterized by highly targeted ... |
| wi0abyrjybki | Trojan | 1 | <h3>Executive Summary</h3> "Wi0abyrjybki" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| wmqarhe5p8fbt | Ransomware | 1 | <h3>Executive Summary</h3> "wmqarhe5p8fbt" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whi... |
| xizfawwyz0ab | Ransomware | 1 | <h3>Executive Summary</h3> "Xizfawwyz0ab" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| xnhmeb | Ransomware | 1 | <h3>Executive Summary</h3> "Xnhmeb" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like naming conve... |
| xxyfhz | Ransomware | 1 | <h3>Executive Summary</h3> "xxyfhz" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appe... |
| za0au42rofm | Ransomware | 1 | <h3>Executive Summary</h3> "za0au42rofm" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which... |
| zy0baazvyqni | Ransomware | 1 | <h3>Executive Summary</h3> "zy0baazvyqni" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (whic... |
| uk_splitter | Trojan | Sampled | UK Splitter (specifically known across security communities as UK Splitter 1.2 and HackTool.Win32.UKSplitter) is a specialized binary joiner, executable file bi... |