Windows Packer pkr_mtsi Powers Widespread Malvertising Campaigns with Multiple Malware
A custom Windows packer known as pkr_mtsi is facilitating large-scale malvertising and SEO-poisoning campaigns, delivering a variety of information-stealing and remote-access malware, as identified in recent research.
A custom Windows packer known as pkr_mtsi is facilitating large-scale malvertising and SEO-poisoning campaigns, delivering a variety of information-stealing and remote-access malware, as identified in recent research.
First detected on Tue, Apr 24, 2025, the packer has evolved while maintaining a stable core that enables consistent detection. Threat actors are utilizing pkr_mtsi to package trojanized installers of legitimate software, leveraging user trust in popular tools to gain initial access. The packer is used with fake download portals that rank highly in search results through malvertising and aggressive SEO tactics.
Pkr_mtsi serves as a general-purpose loader, capable of delivering multiple malware families, including Oyster, Vidar, Vanguard Stealer, and Supper. This flexibility allows operators to adapt payloads with minimal infrastructure changes, aligning with shifting criminal monetization strategies.
On the defensive front, pkr_mtsi leaves several identifiable markers. Antivirus detections often include substrings like “oyster” or “shellcoderunner.” A comprehensive YARA rule has been developed to match all known variants, supported by retro-hunting results.
Technically, pkr_mtsi displays a unique unpacking model. It uses a custom function to allocate memory and reconstruct the next stage from small byte chunks. Earlier versions use a direct VirtualAlloc call, while newer versions employ an obfuscated ZwAllocateVirtualMemory invocation.
First detected on Tue, Apr 24, 2025, the packer has evolved while maintaining a stable core that enables consistent detection.
The packer also supports multiple execution paths, including execution on load and via exported functions, facilitating regsvr32 -based execution and persistence.
The intermediate stage uses a modified UPX module with stripped key markers to complicate static detection. Newer packer versions introduce additional obfuscations, such as migration to hash-based API resolution and junk calls to frustrate analysis.
Despite evasions, the architecture remains consistent: an initial pkr_mtsi layer, a degraded UPX intermediary, and a final payload. Anti-analysis quirks, such as debugger-detection API calls and repeated NtProtectVirtualMemory calls with invalid flags, provide high-signal indicators in EDR telemetry.
Security teams are advised to focus on behavioral detections, emphasizing early-stage allocation followed by dense memory writes. Incident responders should be familiar with pkr_mtsi 's design to expedite triage and unpacking processes.
Future research will delve deeper into UPX stages and associated payload families, as pkr_mtsi continues to drive intrusion chains across the Windows ecosystem.
Based on reporting by GBHackers.