Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware

Research by: Arie Olshtein

Executive summary

• 
  


• Initially observed in July 2016, TrickGate is a shellcode-based packer offered as a service to hide malware from EDRs and antivirus programs.


• Over the last 6 years, TrickGate was used to deploy the top members of the “Most Wanted Malware” list, such as Cerber, Trickbot, Maze, Emotet, REvil, Cobalt Strike, AZORult, Formbook, AgentTesla and more.


• TrickGate managed to stay under the radar for years because it is transformative – it undergoes changes periodically. This …

agenttesla antivirus azorult cerber cobalt cobalt strike edrs emotet executive formbook hide july malware malware research managed maze old packer research revil service shellcode strike trickbot trickgate under