Malware operators hide malicious code within the 7-Zip installer's unpacking portion. G Data Software's analysts identified the altered component, while ESET detects recent samples as OpenSUpdater, and Microsoft refers to it as Snackarcin. However, this approach may overlook code that runs first, as well as the overall security of the package, especially when the signed publisher has little apparent connection to the bundled program.
The loader's insertion point within 7-Zip's SFX stub (Source: G Data) indicates repeated padding bytes in the certificate, while version details resemble unrelated words. Previous trojanized NSIS installer investigations highlight why the packaging deserves careful scrutiny, although these campaigns differ.
Across the samples, the shared features include a genuine installer encapsulated within another installer, a padded but valid certificate, and a loader embedded in modified open-source code. An installer inside another installer, unusual version details, or an oddly padded certificate should prompt a deeper look into less obvious code paths. Here are the indicators of compromise (IoCs): Type Indicator Description SHA-256 a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0 7-Zip self-extracting sample SHA-256 e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c 7-Zip self-extracting sample .
This is done through the use of techniques like [. ], which are compatible with secure platforms like MISP, VirusTotal, or your SIEM. Integrate TI Lookup into your SOC to gain instant context and respond immediately: Power your SOC with instant IOC context for immediate response.
