Packers and Features: Efficacy of Static Analysis for Packed Linux Malware

Packed binaries pose a significant challenge to malware detection, evading static analysis through compression, encryption, and obfuscation techniques. While most research focuses on packed Windows PE files, ELF binaries remain relatively unexplored despite their increasing presence in Linux-taraetina malware. This study presents key insights into the effectiveness of machine learning models in distinguishing packed malware from benign binaries. Detection accuracy based on static analysis features is significantly influenced by the packer implementation. ELF binaries packed with open-source packers like UPX and elf-packer can be accurately classified as either packed malware or packed benign binaries. However, models struggle to generalize detection for binaries packed with advanced packers such as Elfpack and Kiteshield, which employ multi-layer encryption and runtime unpacking. These findings highlight the limitations of static analysis and the need for hybrid approaches that incorporate dynamic analysis. Beyond mal ware detection, packer identification plays a crucial role in understanding packed binaries. This study introduces a methodology to detect and classify packers using static analysis features extracted through reverse engineering. While entropy re-mains a common metric for identifying packed binaries, it proves insufficient against low-entropy packers. Feature engineering en-hances classification performance, with Random Forest achieving an Fl score of 0.959 in distinguishing packers, reinforcing the importance of packer-aware analysis.