Since IoT malware doesn't generally intend to be stealthy, there are usually very few techniques aiming to complicate malware analysis. In addition, as the market is still mainly focused on the Windows platform, it is hard for attackers focusing on Unix systems to buy third-party packers or Fully UnDetected (FUD) services providing on-demand protection for malware. Therefore, apart from basic string or message encryption, UPX still remains the most popular choice in this case, sometimes original and sometimes with extra garbling to prevent sample unpacking using the original tool.
Other basic techniques include sleeping at the beginning of the process in order to bypass simple sandboxes and striping symbol information.
