New Research Paper: Prevalence and impact of low-entropy packing schemes in the malware ecosystem
Summary: Cisco Talos researchers found that over 30 percent of low-entropy files in their dataset adopt some form of run-time packing, and up to 15 percent of low-entropy APT samples from reports and whitepapers were packed. Common tools such as PEiD, DIE, and Manalyze struggled to recognize low-entropy packers, and the best machine-learning classifier detected only 70 percent of packed samples in the low-entropy dataset.
What you should know: Analysts who rely on high entropy as a packing heuristic are missing a substantial share of packed malware, including APT samples, and the best ML classifier tested still missed 30 percent of packed samples.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026