Image: blog.gdatasoftware.com · rights & removal

OpenSUpdater Hides in Recompiled 7zip SFX

Reporting by GData SecurityRead the original at blog.gdatasoftware.com

Executive Summary

Threat actors utilize recompiled open-source software, such as the 7zip SFX stub, to embed reflective loaders into installers for evasion. The process involves understanding how 7zip SFX functions, which uses decompression stubs to handle file extraction and execution, and configuration data appended to the stub that dictates runtime actions like setting window titles or commands. OpenSUpdater samples demonstrate this technique, using self-extracting archives containing genuine installers while employing certificate padding for evasion. The loader functionality is structured around a beacon handler to obtain a Command and Control (C2) URL, a downloader that fetches necessary components via curl, and a reflective loader that decrypts and maps an embedded payload DLL into memory. Other variants exploit open-source libraries like NSIS plugins to achieve similar embedding by using functions like EmbedHtml as insertion points for malicious code execution.

Facts Only

* Threat actors recompile open source software, such as the 7zip SFX stub, to insert reflective loaders.
* OpenSUpdater samples were reported in 2021 by Google regarding certificate parsing to avoid detection.
* Samples are detected as OpenSUpdater by ESET or Snackarcin by Microsoft.
* 7zip SFX functions as a self-extracting archive mechanism.
* SFX modules act as decompression stubs responsible for decompressing archives and running files.
* Configuration data, including execution commands, is stored in plain text appended to the SFX stub.
* The entry point file within an installer is a target for initial analysis by malware analysts.
* OpenSUpdater installers contained foobar2000 installers and were signed by Animated Productions, LLC.
* The certificate is bloated with repeated bytes (0xB8 and 0x84), yet accounts for only 2.6% of the file size.
* The reflective loader functionality includes a beacon handler, a downloader, and a payload loader.
* A variant abuses open-source libraries like NSIS plugins to insert loaders via functions such as EmbedHtml::GetUrl().

Full Take

The observed behavior highlights a persistent tension between the perceived cleanliness of open-source tools and their potential for sophisticated obfuscation. The technique of embedding reflective loaders within legitimate, yet modified, components like 7zip SFX leverages established trust in common utilities to bypass initial security scrutiny, suggesting an attack methodology focused on exploiting analyst inertia rather than technical vulnerabilities alone. The pattern of padding certificates and embedding legitimate installer files suggests a deliberate attempt to create plausible deniability while housing malicious execution paths deep within the file structure. This implies that effective defense requires shifting focus from static signature matching to dynamic behavioral analysis and auditing established software interfaces for unexpected function calls, such as code insertion points or unusual API exports, regardless of superficial signs of legitimacy. What does this pattern suggest about the adversarial relationship with open-source software: is it a constant arms race where legitimate functionality becomes the vehicle for evasion, or is there an emerging paradigm where the inherent complexity of shared libraries introduces systemic vulnerabilities that must be addressed at the architectural level?
BRIDGE QUESTIONS: How can security tooling evolve to dynamically assess the integrity of complex composite archives rather than focusing solely on component signatures? What are the long-term societal implications when core software tools are intentionally repurposed for evasion, and how does this affect public trust in open-source ecosystems? What new analytical methodologies are necessary to effectively map the functional boundaries between benign execution logic and malicious reflective loading within widely used binaries?

From the original · GData Security

Threat actors recompile open source software such as the 7zip SFX stub to sneak a reflective loader into it. Such kind of open source patch is easy to miss by analysts, but to understand why, we need to look at how 7zip SFX generally works and how the loader is hidden in there.

Read the full story at blog.gdatasoftware.com

Sentinel — Human

Confidence

This text reads like a detailed technical breakdown from a malware analyst explaining evasion techniques embedded in file formats, demonstrating deep domain knowledge and forensic thinking.

Signals Detected

Sentence length variance shows natural fluctuation; transition words are used appropriately for logical flow.

The text moves logically from a general concept (SFX) to specific examples (OpenSUpdater) and then to a deeper technical analysis of the evasion techniques, indicating a focused argumentative structure.

The text effectively weaves together system descriptions with malware analysis findings, using cited samples as supporting evidence rather than simply listing facts.

Specific technical details (offsets, function names like ExtractEngine.cpp, specific byte padding) suggest deep domain expertise, making outright fabrication unlikely.

Human Indicators

The text employs the voice of an experienced security analyst detailing a methodology ('how does X work?'), which is characteristic of human-driven instructional or investigative writing.

The concluding summary directly advises an action (stay persistent) based on the preceding evidence, reflecting analytical reasoning rather than mere aggregation.