Static Unpacking for the Widespread NSIS-based Malicious Packer Family

This report analyzes a widespread NSIS-based crypter family called “NSIXloader” used to pack and protect diverse malicious payloads (loaders, stealers, RATs). It documents common NSIS package layouts, DLL/EXE/plugin variants, shellcode and payload decryption routines (including XOR, cyclic shifts, and a modified RC4), provides techniques and Python pseudocode for automated static unpacking, and lists multiple SHA256 IOCs tied to known malware families.