Reported by 5 outlets
OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
G DATA principal researcher Karsten Hahn documents OpenSUpdater installers that hide a reflective loader inside a recompiled 7-Zip SFX decompression stub. The packages embed a genuine foobar2000 setup.exe as the RunProgram target and are validly signed by Animated Productions, LLC, a purported game-app developer; the version info holds random dictionary words and the certificate is padded with repeated 0xB8 and 0x84 bytes, yet the certificate is only 2.6 percent of the file, so size-based sandbox upload limits will not flag it. The loader call is inserted into ExtractArchive at 0x421400, immediately before the progress bar initializes, and the stub's imports and strings still match the genuine module built from CPP/7zip/Bundles/SFXSetup/ExtractEngine.cpp. ESET detects the samples as OpenSUpdater, Microsoft as Snackarcin. A second variant reaches the same result through the NSIS EmbedHtml plugin, firing its loader only when EmbedHtml::GetUrl() is called with an empty string.
This is a five-year operation refining evasion, not a fresh campaign. Google's Threat Analysis Group reported OpenSUpdater in September 2021 for deliberately malformed signatures: an End of Content marker replaced the NULL tag in the SignatureAlgorithm parameters, so OpenSSL-based scanners rejected what Windows accepted. The 2026 move attacks the same boundary from the other side, keeping signatures valid while moving the malicious code into the component triage skips by habit, the standard SFX stub. A successful run gives the victim a beacon that registers with a magic byte sequence, then a statically linked curl inside the stub pulls two DLLs and an encrypted blob; exports cx1 and cx2 decrypt it, a reflective loader maps the resulting DLL into memory and calls export cx3. The final stage therefore exists only in memory and server-side, so analyzing the installer or the extracted foobar2000 file can never reveal what actually ran.
Block and hunt on what is published: the SHA-256 hashes a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0, e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c and ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752, plus DNS and egress alerts for the C2 hosts codeonicinc[.]com and setupsoftwarecenter[.]com. In triage, treat any SFX installer whose signer has no plausible relationship to the payload as hostile until the stub itself is diffed against an official 7-Zip SFX module; the tells are code ahead of progress-bar initialization in ExtractArchive and a statically compiled curl library inside a decompression stub. Flag installer-in-installer packaging, certificates padded with repeated 0xB8 or 0x84 bytes, and version resources built from dictionary words. There is no patch to install, so this is detection engineering and egress control work, not a change-management ticket.
The assessment hinges on two unknowns. G DATA did not obtain the stage-two DLLs, so identification of the payload behind export cx3, or any evidence of distribution scale beyond the foobar2000 lure, would sharpen or overturn the current read. Wider reuse of the pattern is the other marker: the NSIS EmbedHtml variant shows this reflective loader relocates easily between open-source insertion points, and a second family caught patching installers the same way would turn a single operator's trick into a shared technique.
Timeline
-
original reporting
OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection
cyberpress.org · 14d ago · September 29th, 2026
Threat actors are hiding an OpenSUpdater reflective loader inside a recompiled 7-Zip self-extracting archive (SFX) module. The installer contains a genuine foobar2000 setup file, but the malicious code runs from the extraction stub itself a component analysts may overlook when the extracted files appear clean. Recent samples are detected as OpenSUpdater by ESET and Snackarcin by Microsoft. A normal 7-Zip SFX installer combines a decompression stub, a text configuration and an embedded archive. The stub extracts files, writes them to disk and runs a program named in the configuration. An analyst investigating a suspicious installer would therefore have good reason to check that program first. OpenSUpdater Conceals Loader in 7-Zip In the reported samples, that program is a genuine foobar2000 installer named setup.exe . The surrounding package raises questions, however it is signed by Animated Productions, LLC, a purported game-app developer, and its version information contains seemingly random words. Its certificate also contains repeated padding bytes. The padding does not prove what the attacker intended, but the unusual packaging warrants a closer look. Buildup of a 7zip SFX file and its plain text configuration (Source: gdatasoftware) The loader is not hidden in setup.exe or the SFX configuration. Attackers inserted it into recompiled 7-Zip code, immediately before the progress bar is initialized in the ExtractArchive function. At first glance, the stub’s imports, strings
-
update from blog.google
Financially motivated actor breaks certificate parsing to avoid detection
blog.google · 1847d ago · September 23rd, 2021
Google's Threat Analysis Group, writing through researcher Neel Mehta, reported OpenSUpdater as a known unwanted-software family that downloads and installs other suspicious programs, with most targets in the United States and prone to downloading game cracks and grey-area software. Since mid-August 2021 its samples carried deliberately invalid DER signatures in which an End of Content marker replaced the NULL tag of the SignatureAlgorithm parameters, an encoding Windows accepts but OpenSSL-based security products reject. The post includes two sample hashes on VirusTotal and notes Google Safe Browsing was enlisted against the family. G DATA's September 2026 post cites this report as prior OpenSUpdater research.
-
update from blog.gdatasoftware.com
(blog.gdatasoftware.com) Evasion Techniques in Open Source Software: How Threat Actors Hide Reflective Loaders in 7zip SFX and NSIS Installe
blog.gdatasoftware.com · 19d ago · September 24th, 2026
(blog.gdatasoftware.com) Evasion Techniques in Open Source Software: How Threat Actors Hide Reflective Loaders in 7zip SFX and NSIS Installe
via Mastodon https://blog.gdatasoftware.com/2026/09/38490-opensupdater-evades-with-recompiled-7zip-sfx
-
update from gbhackers.com
OpenSUpdater Malware Hides Inside 7-Zip Installers to Evade Detection
gbhackers.com · 14d ago · September 29th, 2026
Threat actors behind the OpenSUpdater malware family are concealing a reflective loader inside recompiled 7-Zip self-extracting archive components, allowing malicious code to blend into otherwise legitimate-looking installers and evade conventional triage. Rather than relying solely on a malicious embedded executable, the operators modify the decompression stub itself the code responsible for unpacking an embedded archive, […] The post OpenSUpdater Malware Hides Inside 7-Zip Installers to Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .