Windows Packer pkr_mtsi Powers Widespread Malvertising Campaigns Delivering Multiple Malware Families
A sophisticated Windows packer, referred to as pkr_mtsi, has been identified as a significant tool for delivering various malware families through extensive malvertising campaigns.
A sophisticated Windows packer, referred to as pkr_mtsi, has been identified as a significant tool for delivering various malware families through extensive malvertising campaigns.
Detected initially on Mon, Apr 24, 2025, this malicious packer remains actively operational, distributing trojanized installers that masquerade as legitimate software applications.
The packer targets popular tools like PuTTY, Rufus, and Microsoft Teams by employing fake download websites that achieve high search engine rankings through malvertising and SEO poisoning techniques.
The pkr_mtsi packer functions as a general-purpose loader rather than a single-payload wrapper, distributing diverse malware families including Oyster, Vidar, Vanguard Stealer, and Supper.
Distribution occurs when users download what appears to be legitimate software from counterfeit websites. These sites are carefully crafted imitation platforms, not the result of supply chain attacks, designed to deceive users seeking trusted utilities.
Over the past eight months, researchers at ReversingLabs have observed significant evolution in pkr_mtsi, with the incorporation of complex obfuscation methods and anti-analysis techniques.
Despite these advancements, the packer maintains consistent structural and behavioral characteristics that support reliable detection.
Distribution occurs when users download what appears to be legitimate software from counterfeit websites.
ReversingLabs analysts identified that antivirus products often flag the packer using substrings like "oyster" or "shellcoderunner," though detection coverage varies across security tools.
Technical Execution and Memory Allocation
The packer operates by allocating memory regions where the next execution stage is written. Initially, it used direct calls to VirtualAlloc, while recent variants utilize obfuscated calls to ZwAllocateVirtualMemory.
Following memory allocation, the packer reconstructs payloads by dividing them into small chunks ranging from one to eight bytes, stored as immediate values within the instruction stream. Later versions pass these chunks through decoding routines before writing them to specific memory offsets.
Early pkr_mtsi variants resolved DLLs and API functions from plaintext strings, but newer versions now use hashed identifiers combined with Process Environment Block traversal.
The packer also employs extensive junk calls to GDI API functions, which serve no functional purpose other than to hinder static and behavioral analysis efforts. These characteristics form reliable detection signatures.
The packer exists in both executable and dynamic-link library formats. DLL variants support multiple execution contexts, with one pathway triggering reliably on DLL load to unpack the next stage and final payload.
Several DLL samples export DllRegisterServer, enabling malware loading through regsvr32.exe and providing persistent execution through registry-based COM registration.
The intermediate stage consists of a modified UPX-packed module with identifying components selectively removed to evade detection. Headers, magic values, and ancillary metadata are stripped while maintaining execution capability.
This deliberate degradation complicates both static identification and automated unpacking processes, posing a challenge for security researchers.
Based on reporting by Cyber Security News.