{"id":52182,"date":"2016-08-25T16:34:01","date_gmt":"2016-08-25T23:34:01","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=52182"},"modified":"2025-06-02T19:34:12","modified_gmt":"2025-06-03T02:34:12","slug":"malware-hides-in-installer-to-avoid-detection","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-hides-in-installer-to-avoid-detection\/","title":{"rendered":"Malware Hides in Installer to Avoid Detection"},"content":{"rendered":"

At McAfee Labs we recently observed various threat families using the Nullsoft Scriptable Install System (NSIS). This practice is not new, but our analysis shows that several malware families are employing the same technique to hide their packed executable code. Usually every malware family uses its own polymorphic packers to obfuscate its payload. In this case four families have the\u00a0same executable format\u00a0to hide the malicious code.<\/p>\n

The malicious NSIS package contains a DLL (acting as a decryptor and injector) and an encrypted executable payload. Once onboard an infected machine, the NSIS package drops a DLL and two data files and loads the DLL. The DLL decrypts the two data files and executes the final payload using process hollowing, a technique used by malware in which the original code is replaced with malicious code. If we were to analyze the DLL alone, we would not conclude that it was malicious because it relies on encrypted data in the two data files.<\/p>\n

We found four malware families using this technique:<\/p>\n