OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installers

Key facts

Detection coverage

As of 2026-09-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2767 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OpenSUpdater Known-Sample SHA-256 Execution or Load — Exploitation Phase

Fires when a published OpenSUpdater sample (G DATA 2026-09-24: two recompiled 7-Zip SFX stubs and one NSIS EmbedHtml variant; Google TAG 2021: two historical malformed-signature samples) is executed or loaded. Certificate padding (0xB8/0x84, ~2.6% of file size) changes the hash per build, so this is a high-fidelity floor for known builds, not full family coverage; pair with the behavioral detections.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036
• Data sources: sysmon, microsoft_defender_xdr
• Severity: high
• Confidence: high

Splunk SPL

```OpenSUpdater IOC hashes: G DATA 2026-09-24 (3) + Google TAG 2021 (2)```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (1,7) Hashes IN ("*a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0*","*e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c*","*ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752*","*5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f*","*5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db*")
| eval event_type=if(EventCode=1,"process_create","image_load"), file_path=coalesce(ImageLoaded,Image)
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line values(User) as user by host, event_type, file_path, Hashes
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ioc_sha256 = dynamic(["a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0","e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c","ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752","5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f","5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db"]);
union isfuzzy=true
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where SHA256 in~ (ioc_sha256) or InitiatingProcessSHA256 in~ (ioc_sha256)
 | project Timestamp, DeviceName, Source="DeviceProcessEvents", FileName, FolderPath, SHA256, CommandLine=ProcessCommandLine, ParentName=InitiatingProcessFileName, Account=AccountName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where SHA256 in~ (ioc_sha256)
 | project Timestamp, DeviceName, Source="DeviceFileEvents", FileName, FolderPath, SHA256, CommandLine=InitiatingProcessCommandLine, ParentName=InitiatingProcessFileName, Account=InitiatingProcessAccountName),
(DeviceImageLoadEvents
 | where Timestamp > ago(24h)
 | where SHA256 in~ (ioc_sha256)
 | project Timestamp, DeviceName, Source="DeviceImageLoadEvents", FileName, FolderPath, SHA256, CommandLine=InitiatingProcessCommandLine, ParentName=InitiatingProcessFileName, Account=InitiatingProcessAccountName)
| order by Timestamp desc

Sigma

title: OpenSUpdater Known Sample Hash Executed
id: 3f0c8a52-7d41-4b6e-9a1f-5c2e8d7b1a01
status: experimental
description: Detects execution of published OpenSUpdater samples (recompiled 7-Zip SFX stubs and the NSIS EmbedHtml variant, plus two 2021 Google TAG samples) by SHA-256. Certificate padding changes the hash per build, so this only covers known builds.
references:
    - https://blog.gdatasoftware.com/2026/09/38490-opensupdater-evades-with-recompiled-7zip-sfx
    - https://blog.google/threat-analysis-group/financially-motivated-actor-breaks-certificate-parsing-avoid-detection/
author: Threadlinqs Team
date: 2026/09/29
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Hashes|contains:
            - 'a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0'
            - 'e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c'
            - 'ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752'
            - '5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f'
            - '5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db'
    condition: selection
falsepositives:
    - Security researchers or sandboxes detonating the published samples
level: high

Known false positives:

• Malware analysts or sandboxes intentionally executing the published samples

Tuning notes: Sysmon must log EventCode 1 (and 7 for module loads) with hashes enabled including SHA256 in HashType. Refresh the hash list from the threat record as new builds are published; because padding varies the hash per build, rely on the behavioral detections for coverage.

• 🔒 OpenSUpdater Executable Signed by 'Animated Productions, LLC' — Publisher Mismatch · unlock with TL Creds
• 🔒 OpenSUpdater cx1/cx2/cx3 DLL Export Invocation via rundll32 — Reflective Loader Chain · unlock with TL Creds
• 🔒 Installer Stub Beacons Over HTTPS Then Launches Nested foobar2000 Installer — Loader Before Install · unlock with TL Creds
• 🔒 foobar2000 Installer Launched From SFX/NSIS Temp Extraction Directory — Installer-Within-Installer · unlock with TL Creds
• 🔒 Downloaded Executable Stages Multiple DLLs Into Temp/AppData — Loader DLL Download Staging · unlock with TL Creds
• 🔒 curl User-Agent in Proxy Traffic From Workstations — Statically Compiled cURL Downloader · unlock with TL Creds
• 🔒 Modified NSIS EmbedHtml Plugin DLL Loaded From NSIS Temp Directory — Post-Exploitation · unlock with TL Creds
• 🔒 OpenSUpdater C2 Domain Contact ([indicator] / [indicator]) — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-09-29, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2767.

Sample indicators (3 of 17)

• Domain: codeonicinc[.]com
• File hash: a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0
• Domain: setupsoftwarecenter[.]com

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

G DATA (published 2026-09-24) documents a new evolution of the OpenSUpdater family, an unwanted-software / adware-downloader family first publicly documented by Google's Threat Analysis Group (TAG) on 2021-09-23 for shipping intentionally malformed Authenticode signatures since mid-August 2021. Instead of hiding malicious code in the bundled setup.exe or the SFX configuration, the operators recompile 7-Zip's SFX setup module and insert the loader into the ExtractArchive() routine (call at offset 0x421400 in the first sample; the legitimate routine lives in CPP/7zip/Bundles/SFXSetup/ExtractEngine.cpp), immediately before the progress bar is initialized. Analysts who triage SFX archives by inspecting the embedded executable and configuration therefore miss the malicious path, which lives in what appears to be a trusted, standard 7-Zip component.

The loader performs three functions: (1) it retrieves C2 URLs through an obfuscated routine and registers with the C2 using a distinct magic byte sequence; (2) it uses a statically compiled cURL to download two DLLs and an encrypted blob from the C2; and (3) it executes the payload in memory. The first DLL's export cx1 is invoked, the second DLL's export cx2 decrypts the blob, and the resulting DLL is reflectively mapped into memory and its export cx3 executed. G DATA describes the final DLL as the presumed payload; the analyst states no DLLs were obtained from the C2 at the time of analysis, so the payload's function is unknown.

The analyzed samples package a genuine foobar2000 audio-player installer (setup.exe) as cover (an installer-within-installer structure) and carry a valid signature from 'Animated Productions, LLC', a purported game-application developer, producing a publisher-to-payload mismatch. The certificate data is bloated with repeated byte patterns (0xB8 and 0x84) amounting to roughly 2.6% of file size, which changes the file hash per build without invalidating the signature and hinders hash-based detection. Samples also carry random version-information strings. A second variant modifies the NSIS EmbedHtml plugin, placing the loader in EmbedHtml::GetUrl() so that it activates only when called with an empty-string argument; in that variant the C2 address is recovered from a compressed blob inside the NSIS script. Two C2 domains were identified: codeonicinc[.]com (both 7-Zip-variant samples) and setupsoftwarecenter[.]com (the NSIS-variant sample). Detection names: ESET 'OpenSUpdater' and Microsoft 'Snackarcin' on related samples.

Attribution and scale are unestablished: no CVE, named threat actor, or victim count was disclosed. Google TAG's and BleepingComputer's 2021 reporting characterized OpenSUpdater as adware/riskware that injects ads and installs other unwanted programs, with targets mostly in the US seeking game cracks and other grey-area software. The 2021 TAG technique was a signature-algorithm parameters element with an End-of-Content marker in place of a NULL tag (bytes 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 00 00), accepted by Windows but rejected by OpenSSL-based parsers. A link between that reporting and the 2026 operators' identity is not established beyond the shared family name. BeaconBeagle config search for setupsoftwarecenter.com returned no matches.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.001 Obfuscated Files or Information: Binary Padding; T1027.009 Obfuscated Files or Information: Embedded Payloads; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036 Masquerading; T1036.001 Masquerading: Invalid Code Signature; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Execution

T1204.002 User Execution: Malicious File

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Remediation

Immediate actions

• Block and alert on outbound connections to codeonicinc.com and setupsoftwarecenter.com
• Hunt for the three published SHA-256 hashes and for setup.exe / foobar2000 installers signed by 'Animated Productions, LLC'
• Quarantine hosts where an SFX/NSIS installer spawned a process that then made HTTPS downloads and loaded unbacked (reflectively mapped) DLLs

Workarounds

• Enforce application control so that only approved publishers' installers can execute
• Egress-filter newly registered or uncategorized domains from user workstations

Longer-term hardening

• Do not treat a valid code signature or a legitimate-looking extracted installer as proof of safety; analyze the SFX stub and bundled NSIS plugin code
• Diff SFX stubs and NSIS plugins against upstream builds to catch recompiled components
• Detect certificate anomalies such as oversized or padded signature blocks, malformed signature-algorithm structures, and publisher-to-product mismatches
• Flag installer-within-installer configurations and anomalous or random version-information metadata
• Deploy EDR with behavioral coverage for reflective code loading and in-memory DLL mapping
• Restrict installation of software from untrusted sources through application allow-listing

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints executing the trojanized SFX/NSIS installers

Timeline

• 2021-08-15 Google TAG observes OpenSUpdater samples carrying intentionally malformed signatures since mid-August 2021 (exact day not stated; mid-month used).
• 2021-09-23 BleepingComputer covers the TAG finding, describing OpenSUpdater as adware/riskware that injects ads and installs other unwanted programs.
• 2021-09-23 Google TAG publishes 'Financially motivated actor breaks certificate parsing to avoid detection' (researcher Neel Mehta), documenting the family's End-of-Content signature trick and two sample hashes; targets mostly US users seeking game cracks.
• 2026-09-24 OffSeq Threat Radar ingests the G DATA report and lists the three SHA-256 hashes, two C2 domains and mapped ATT&CK techniques.
• 2026-09-24 G DATA publishes 'OpenSUpdater Hides in Recompiled 7zip SFX, Evading Analysts', detailing the loader in the recompiled 7-Zip SFX stub (ExtractArchive at 0x421400) and the NSIS EmbedHtml::GetUrl variant, with three SHA-256 hashes and two C2 domains; the analyst obtained no DLLs from the C2.
• 2026-09-29 Threadlinqs opens tracking record TL-2026-2767 for the OpenSUpdater 7-Zip SFX loader campaign.
• 2026-09-29 GBHackers publishes coverage of the G DATA analysis, highlighting the reflective loader, cx1/cx2/cx3 chain and Animated Productions, LLC signature.
• 2026-09-29 CyberPress publishes coverage naming ESET (OpenSUpdater) and Microsoft (Snackarcin) detections and repeating the IOCs.

Sources cited

• OpenSUpdater Hides in Recompiled 7zip SFX, Evading Analysts (OffSeq Threat Radar) radar.offseq.com · Advisory · 2026-09-24
• OpenSUpdater Hides in Recompiled 7zip SFX, Evading Analysts (G DATA) blog.gdatasoftware.com · Research · 2026-09-24
• Financially motivated actor breaks certificate parsing to avoid detection (Google TAG) Google · Research · 2021-09-23
• OpenSUpdater Malware Hides Inside 7-Zip Installers to Evade Detection (GBHackers) gbhackers.com · News · 2026-09-29
• OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection (CyberPress) cyberpress.org · News · 2026-09-29
• Malware devs trick Windows validation with malformed certs (BleepingComputer) BleepingComputer · News · 2021-09-23

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of Canon and Stardock Binaries Previous report
• SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows Defenses Next report