> Technique · LZSS Payload Decompression_

~/packetpursuit $ cat /intel/techniques/lzss-payload-decompression.md

typetechniqueconfidencehighcreated2026-06-04updated2026-06-04obfuscationdefense-evasionmalware-familyloader

LZSS Payload Decompression

What It Does

LZSS (Lempel-Ziv-Storer-Szymanski) is a sliding-window dictionary compressor used by the SilverFox/ValleyRAT cluster to hide its second-stage payload inside the PE. At runtime, a small decompressor stub extracts the payload into newly allocated executable memory before injecting it into a suspended child process.

Detection / Fingerprint

  • Embedded payload compressed with a 4096-byte window (12-bit offset mask 0xfff).
  • Decompressor stub contains and r8d, 0xfff followed by shr eax, 0xc (or equivalent) to split control tokens into offset and length fields.
  • Decompressed stage is immediately followed by process-injection API calls: NtAllocateVirtualMemory, NtWriteVirtualMemory.
  • Compressed entropy is typically 5.5–6.5; decompressed stage is a valid PE/DLL with entropy ~6.0–7.0.

Implementation Patterns

  • Control word format: 16-bit token where the low 12 bits are the back-reference offset and the high 4 bits encode match length (bias +3).
  • If the match-length bit is zero, a literal byte is copied directly.
  • Large copies are accelerated with SSE xmmword moves via a helper like fcn.140006300 (16/32/64-byte alignment branches).

Reproduce on Your Own VMs

  1. Compress a second-stage PE with any LZSS encoder using a 4096-byte window.
  2. Embed the raw compressed bytes as a .rdata or .rsrc byte array.
  3. Implement a decoder loop:
    uint16_t token = *(uint16_t *)src;
uint16_t offset = token & 0xfff;
uint8_t  len    = (token >> 12) + 3;
if (len == 3) { *dst++ = *src++; }
else { memcpy(dst, dst - offset, len); dst += len; }
  4. Allocate executable memory (VirtualAlloc / NtAllocateVirtualMemory) and copy the decompressed stage.
  5. Inject into a suspended child via CreateProcessW + NtWriteVirtualMemory.

Defensive Countermeasures

  • Memory scanners should flag and [reg], 0xfff patterns near allocation APIs.
  • Behavioral detection: large NtWriteVirtualMemory to a recently created suspended process.

Related