T1027.002

Official Description

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing)

Tactics: Stealth
Platforms: Linux, macOS, Windows
Parent Technique: T1027 · Obfuscated Files or Information
MITRE Version: 2.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (1)

A packed loader and further packed stages were identified in the infection chain. Aqua Details Fileless Cryptomining Campaign Targeting Containerized Apps

Malware (1)

MITRE ATT&CK (10)

Vendors (1)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.