# OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installers

> OpenSUpdater operators are hiding a reflective loader inside the decompression stub of recompiled 7-Zip self-extracting archives (and a modified NSIS EmbedHtml plugin), wrapping a genuine foobar2000 installer and signing the result as 'Animated Productions, LLC'. The loader beacons to C2, downloads two DLLs and an encrypted blob with a statically compiled cURL, and runs the final payload in memory via a cx1/cx2/cx3 DLL chain.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2767
- **ID:** TL-2026-2767
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

G DATA (published 2026-09-24) documents a new evolution of the OpenSUpdater family, an unwanted-software / adware-downloader family first publicly documented by Google's Threat Analysis Group (TAG) on 2021-09-23 for shipping intentionally malformed Authenticode signatures since mid-August 2021. Instead of hiding malicious code in the bundled setup.exe or the SFX configuration, the operators recompile 7-Zip's SFX setup module and insert the loader into the ExtractArchive() routine (call at offset 0x421400 in the first sample; the legitimate routine lives in CPP/7zip/Bundles/SFXSetup/ExtractEngine.cpp), immediately before the progress bar is initialized. Analysts who triage SFX archives by inspecting the embedded executable and configuration therefore miss the malicious path, which lives in what appears to be a trusted, standard 7-Zip component.

The loader performs three functions: (1) it retrieves C2 URLs through an obfuscated routine and registers with the C2 using a distinct magic byte sequence; (2) it uses a statically compiled cURL to download two DLLs and an encrypted blob from the C2; and (3) it executes the payload in memory. The first DLL's export cx1 is invoked, the second DLL's export cx2 decrypts the blob, and the resulting DLL is reflectively mapped into memory and its export cx3 executed. G DATA describes the final DLL as the presumed payload; the analyst states no DLLs were obtained from the C2 at the time of analysis, so the payload's function is unknown.

The analyzed samples package a genuine foobar2000 audio-player installer (setup.exe) as cover (an installer-within-installer structure) and carry a valid signature from 'Animated Productions, LLC', a purported game-application developer, producing a publisher-to-payload mismatch. The certificate data is bloated with repeated byte patterns (0xB8 and 0x84) amounting to roughly 2.6% of file size, which changes the file hash per build without invalidating the signature and hinders hash-based detection. Samples also carry random version-information strings. A second variant modifies the NSIS EmbedHtml plugin, placing the loader in EmbedHtml::GetUrl() so that it activates only when called with an empty-string argument; in that variant the C2 address is recovered from a compressed blob inside the NSIS script. Two C2 domains were identified: codeonicinc[.]com (both 7-Zip-variant samples) and setupsoftwarecenter[.]com (the NSIS-variant sample). Detection names: ESET 'OpenSUpdater' and Microsoft 'Snackarcin' on related samples.

Attribution and scale are unestablished: no CVE, named threat actor, or victim count was disclosed. Google TAG's and BleepingComputer's 2021 reporting characterized OpenSUpdater as adware/riskware that injects ads and installs other unwanted programs, with targets mostly in the US seeking game cracks and other grey-area software. The 2021 TAG technique was a signature-algorithm parameters element with an End-of-Content marker in place of a NULL tag (bytes 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 00 00), accepted by Windows but rejected by OpenSSL-based parsers. A link between that reporting and the 2026 operators' identity is not established beyond the shared family name. BeaconBeagle config search for setupsoftwarecenter.com returned no matches.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1036 Masquerading
- T1553.002 Subvert Trust Controls: Code Signing
- T1036.001 Masquerading: Invalid Code Signature
- T1027 Obfuscated Files or Information
- T1027.001 Obfuscated Files or Information: Binary Padding
- T1027.009 Obfuscated Files or Information: Embedded Payloads
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [OpenSUpdater Hides in Recompiled 7zip SFX, Evading Analysts (G DATA)](https://blog.gdatasoftware.com/2026/09/38490-opensupdater-evades-with-recompiled-7zip-sfx)
- [OpenSUpdater Malware Hides Inside 7-Zip Installers to Evade Detection (GBHackers)](https://gbhackers.com/opensupdater-malware/)
- [OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection (CyberPress)](https://cyberpress.org/opensupdater-conceals-loader-in-7-zip/)
- [OpenSUpdater Hides in Recompiled 7zip SFX, Evading Analysts (OffSeq Threat Radar)](https://radar.offseq.com/threat/opensupdater-hides-in-recompiled-7zip-sfx-evading-analysts-e55d073dd2577d97)
- [Financially motivated actor breaks certificate parsing to avoid detection (Google TAG)](https://blog.google/threat-analysis-group/financially-motivated-actor-breaks-certificate-parsing-avoid-detection/)
- [Malware devs trick Windows validation with malformed certs (BleepingComputer)](https://www.bleepingcomputer.com/news/security/malware-devs-trick-windows-validation-with-malformed-certs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2767