OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection

Threat actors are hiding an OpenSUpdater reflective loader inside a recompiled 7-Zip self-extracting archive (SFX) module.

The installer contains a genuine foobar2000 setup file, but the malicious code runs from the extraction stub itself a component analysts may overlook when the extracted files appear clean. Recent samples are detected as OpenSUpdater by ESET and Snackarcin by Microsoft.

A normal 7-Zip SFX installer combines a decompression stub, a text configuration and an embedded archive.

The stub extracts files, writes them to disk and runs a program named in the configuration. An analyst investigating a suspicious installer would therefore have good reason to check that program first.

OpenSUpdater Conceals Loader in 7-Zip

In the reported samples, that program is a genuine foobar2000 installer named setup.exe. The surrounding package raises questions, however it is signed by Animated Productions, LLC, a purported game-app developer, and its version information contains seemingly random words.

Its certificate also contains repeated padding bytes. The padding does not prove what the attacker intended, but the unusual packaging warrants a closer look.

The loader is not hidden in setup.exe or the SFX configuration. Attackers inserted it into recompiled 7-Zip code, immediately before the progress bar is initialized in the ExtractArchive function.

At first glance, the stub’s imports, strings and main execution path resemble those of an ordinary SFX module. That makes the changed code harder to spot during a quick inspection.

The inserted code has three main jobs: contact a command-and-control (C2) server, download components and load a payload into memory.

It obtains an obfuscated C2 address and registers with the server using a distinctive byte sequence. Statically compiled curl functions then request two DLLs and an encrypted data blob.

The reflective loader calls the cx1 export in the first DLL and the cx2 export in the second to decrypt the blob. It then maps the resulting DLL into memory and calls its cx3 export. The researcher could not retrieve those server-hosted DLLs, so the final payload’s behavior remains unconfirmed.

A related variant places its loader in the open-source NSIS EmbedHtml plugin. Calling EmbedHtml::GetUrl() with an empty string triggers that code, which reads a C2 address from compressed data in the NSIS script.

Both approaches bury malicious logic in software components that can appear routine beside a genuine application installer.

The reported SHA-256 sample hashes are a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0, e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c and ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752.

Reported C2 domains are codeonicinc[.]com for the 7-Zip samples and setupsoftwarecenter[.]com for the NSIS variant, gdatasoftware said.

Google reported an earlier OpenSUpdater certificate-parsing evasion technique in 2021. The newer findings show why a valid signature or a harmless extracted file is not enough to clear an installer: when other details look suspicious, analysts should examine the SFX stub or bundled plugin code as well.blog+1

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team