Redtail Upx Packed Multiarch Elf

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•1

Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.