Security Affairs

JULY 20, 2024

The attackers attempted to trick the company’s customers into opening a ZIP archive file named “ crowdstrike-hotfix.zip.” ” The archive includes a loader named Hijack Loader used to execute the Remcos RAT. The ZIP archive contains a HijackLoader payload that, when executed, loads RemCos.

File names 251

File names Archiving Cybersecurity Communications 251

Security Affairs

DECEMBER 23, 2021

In the initial attacks observed by the researchers, the malicious code downloads a Microsoft Cabinet (CAB) archive containing a malicious executable. “In the initial versions of CVE-2021-40444 exploits, malicious Office document retrieved a malware payload packaged into a Microsoft Cabinet (or.CAB) file.

Archiving 363

Archiving File names Security Ransomware 363

Security Affairs

FEBRUARY 29, 2024

The PDF included a link to a fake questionnaire that redirects users to a mailcious ZIP archive hosted on a compromised site. The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code. The JavaScript code retrieves an encoded ZIP archive containing WINELOADER from the same domain.

Archiving 330

Archiving File names IT Information Security 330

Security Affairs

JULY 13, 2022

“Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel (XLM) 4.0 ThreatLabz reported that the attackers are using various different file names to disguise attachments designed to deliver Qakbot.

File names 342

File names Archiving Compliance IT 342

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 298

File names Archiving Passwords Communications 298

Security Affairs

APRIL 5, 2022

The messages use the HTML-file “War criminals of the Russian Federation.htm” as attachment. Upon opening the file, a RAR-archive named “Viyskovi_zlochinci_RU.rar” is created. .

Military 346

Military Phishing File names Archiving 346

Security Affairs

JANUARY 5, 2025

In one case analyzed by the researchers, the attack chain begins by tricking the victim into opening a malicious RAR archive disguised as an image file by using a.jpg extension. Upon executing the archive, it drops a malicious Windows executable, which eventually downloads and executesthe PLAYFULGHOST payloadfrom a remote server.

File names 246

File names Archiving Phishing Encryption 246

Security Affairs

MARCH 15, 2020

Researchers from MalwareHunterTeam discovered a suspicious RAR file named “COVID-19-” that was being distributed online, likely through phishing emails. "Important The RAR archive contains a file named “Important – COVID-19” that displays a Word icon.

Communications 357

Communications File names Archiving Phishing 357

Security Affairs

JULY 30, 2024

When this.html file is opened, it displays an image designed to create a sense of urgency about accessing the document, thereby increasing the likelihood that the user will follow the provided instructions.” “The command, as illustrated above, first runs ipconfig /flushdns, then creates a folder on the C: drive named “downloads.”

Phishing 358

Phishing File names Archiving Access 358

Security Affairs

JULY 17, 2020

In stats folder are maintained two up-to-date files: files_name it holds the frequency of the found file-names associate with kits. In other words every phishing kit is saved on the phishing host with a name. filke_name keeps track about every file names and its frequency.

Phishing 352

Phishing File names Archiving IT 352

Security Affairs

JUNE 26, 2021

The provided sample of exfiltrated files includes business data and documents, as well as Argus certificates and development files. The sample archive is password protected – but the file names and types are clearly visible. Altus Group has been informed about the new development.

Ransomware 340

Ransomware File names Archiving Encryption 340

Security Affairs

SEPTEMBER 16, 2024

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” “The specific flaw exists within the way Internet Explorer prompts the user after a file is downloaded. ” reads the advisory published by ZDI.

Archiving 342

Archiving File names Libraries Passwords 342

Security Affairs

MARCH 3, 2020

Nemty ransomware first appeared on the threat landscape in August 2019, the name of the malware comes after the extension it adds to the encrypted file names. The ransomware deletes shadow copies of encrypted files to make in impossible any recovery procedure. they also announced a working tool for version 1.5.

Ransomware 335

Ransomware File names Encryption Archiving 335

Security Affairs

MARCH 28, 2022

The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.” “The archive contains documents and images of the bait, as well as VBScript code (Thumbs.db), which will create and run the.NET program “dhdhk0k34.com.”

Archiving 246

Archiving CMS File names Phishing 246

Security Affairs

FEBRUARY 21, 2023

The two vulnerabilities, tracked as CVE-2022-39952 and CVE-2021-42756 , are respectively an external control of file name or path in Fortinet FortiNAC and a collection of stack-based buffer overflow issues in the proxy daemon of FortiWeb. is an external control of file name or path in the keyUpload scriptlet of FortiNAC.

File names 246

File names Archiving Access Cybersecurity 246

Security Affairs

JULY 28, 2024

The spear-phishing page included a download link pointing to a ZIP archive file that contained a malicious InnoSetup installer. The installer injected the executable into a JavaScript file named “jquery-3.7.1.min.js” min.js” to evade detection.

Passwords 359

Passwords Phishing File names Metadata 359

Security Affairs

MARCH 28, 2019

The recently patched vulnerability affecting the popular archiver utility WinRAR has been exploited to deliver new malware to targeted users. The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. ” continues the analysis.

Archiving 267

Archiving File names Education Libraries 267

Security Affairs

JUNE 29, 2023

Fortinet started investigating the threat after the discovery of an archive file with a file name in Russian, “Табель учета рабочего времени.zip” (“time sheet” in English). The zip archive contains two files with.exe extension preceded by another document-related extension (double extension).

File names 189

File names Archiving IT Security 189

Security Affairs

SEPTEMBER 23, 2024

The phishing emails in this campaign have carefully tailored subject lines, with a ZIP file attachment containing a decoy MSC file named RIPCOY. Upon opening this file, an obfuscated VBScript downloads multiple files from a public cloud service like AWS, including a decoy PDF,NET applications, and a configuration file.

Phishing 349

Phishing File names Cloud Government 349

Security Affairs

MARCH 17, 2020

The script creates a new file named “ pinumber.vbs ” and starts filling it with the instructions through the “echo” function appending the strings to the next vbs stage. An evidence about the presence of the malicious file hosted on the legit website is shown in the following figure: Figure 5: Communication with the DropUrl.

Archiving 363

Archiving Passwords Encryption IT 363

Security Affairs

SEPTEMBER 22, 2022

A user-assisted remote attacker can trigger the issue to overwrite arbitrary files via a. dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. sequence to filenames in a TAR archive.” however, in most cases an attacker exploit this issue to gain code execution from the file write. .

Archiving 264

Archiving File names Metadata Security 264

Security Affairs

MARCH 17, 2024

The researchers noticed that the users must unpack several layers of archives using the password “GIT1HUB1FREE,” which is provided in the README.md file, to access the installer named “Installer_Mega_v0.7.4t.msi.” All unique passwords are stored in a file named “brute.txt”.

Passwords 348

Passwords File names Archiving Cybersecurity 348

Security Affairs

JUNE 19, 2023

“For MacOS devices, the function writes a file to /Users/Shared/AppleAccount.tgz. The content that is written to the archive is also encoded as base64 when received from server. It unpacks the archive to the /Users/Shared folder, then opens the /Users/Shared/TempUser/AppleAccountAssistant.app application.”

File names 246

File names Archiving IT Security 246

Security Affairs

MARCH 15, 2019

The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. DLL, handles the extraction of files compressed in ACE data format. The malicious RAR file (Ariana_Grande-thank_u,_next(2019)_[320].rar)

Archiving 272

Archiving Libraries File names Security 272

Security Affairs

AUGUST 18, 2023

Then the loaders retrieve a second-stage payload stored in password-protected ZIP archive from Alibaba buckets. “The zip archives downloaded by agentupdate_plugins.exe and AdventureQuest.exe contain sideloading capabilities. The attackers used modified installers for chat applications to download a.NET malware loaders.

Archiving 246

Archiving File names Encryption Passwords 246

Security Affairs

JANUARY 12, 2022

Stolen data are stored in an archive (logs) before being uploaded to a server under the control of the attackers. The new variant discovered by Fortinet has the file name “Omicron Stats.exe,” threat actors are attempting to exploit the enormous interest on a global scale on the COVID-19 Omicron variant.

Manufacturing 363

Manufacturing File names Archiving Encryption 363

Security Affairs

OCTOBER 22, 2023

.” A Vietnamese group observed by the researchers used very similar lures and delivery methods in different attacks attempting to deliver: DarkGate Ducktail Lobshot Redline stealer The attack chain began with the download of a file named “Salary and new products.8.4.zip” zip” and the execution of the content.

File names 336

File names Archiving IT Access 336

Security Affairs

APRIL 3, 2022

Files in the Borat RAT archive (Cyble). If it can find a connected microphone, the RAT records all audio and saves it in a file named micaudio.wav. The Borat RAT allows its operators to compile the malware binary for performing specific features, including DDoS and ransomware attacks.

Ransomware 334

Ransomware File names Archiving Encryption 334

Security Affairs

JULY 14, 2021

The Dropbox link leads to a RAR archive that masquerades as a Word document by setting the “file_subpath” parameter to point to a filename with a.DOCX extension. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files.

Archiving 246

Archiving File names Government Libraries 246

Security Affairs

JUNE 4, 2019

The infection chain is composed by different stages of password protected SFX (self extracting archive), each containing vbs or batch scripts. Despite its apparent triviality, the Matryoshka of SFX archives reached a low detection rate, making it effective. Information about initial SFX file. Technical Analysis. scr” extension.

Archiving 235

Archiving Passwords File names Military 235

Security Affairs

JUNE 24, 2024

While investigating a security incident from March 2024 on a client’s Linux host, Positive Technologies researchers discovered a file named “scrond.” The backdoor serializes, encrypts, archives, and sends the collected data to a designated server that stores compromised data.

File names 291

File names Communications Mining Archiving 291

Security Affairs

MARCH 26, 2021

Experts noticed that each Hades ransomware sample uses a different extension to files that it encrypts and drops a ransom note with file name “HOW-TO-DECRYPT-[extension].txt”. “In addition to data theft, actors deploy Hades ransomware to encrypt files identified on the victim network. ” concludes the report.

Ransomware 363

Ransomware Encryption File names Manufacturing 363

Security Affairs

JUNE 6, 2023

.” Encrypted file contents in Windows Encrypted file contents in Linux The Windows version of the info-stealer can be downloaded from the Cyclops admin panel as part of an archive containing the stealer.exe and config.json. The data is then exfiltrated to the attacker’s server.” ” continues the report.

Ransomware 245

Ransomware Encryption Archiving File names 245

Security Affairs

MARCH 29, 2019

This messages warned the users about imminent summons against them, inviting them to read the attached lawsuit, a not so innocent looking file named “ Avviso del tribunale.jar ”. Encryption key used to decrypt all the other files. Encryption key used to decrypt all the other files. Technical Analysis.

Encryption 276

Encryption File names Archiving IT 276

Security Affairs

AUGUST 23, 2023

This downloader was used to install the Korplug backdoor on the infected systems. “The downloader attempted to download a file named update.zip from the following location: [link] continues the report. “The update.zip file is a zlib compressed archive file. This file is not saved on disk.

File names 246

File names Encryption Archiving Information Security 246

Security Affairs

MARCH 1, 2021

. “And if that same site visitor clicks the “direct download link” provided on this page, they receive a.zip archive file with a filename that exactly matches the search query terms used in the initial search, which itself contains another file named in precisely the same way.” ” continues the analysis.

Search queries 313

Search queries CMS Ransomware File names 313

Security Affairs

JUNE 25, 2019

The second feature that was exploited to include within ZIP archives symbolic links pointing to arbitrary locations, in this case, automount endpoints. Cavallarin discovered that the software responsible for decompressing the ZIP archives does not perform any check on the symlinks. /net/evil-attacker.com/sharedfolder/).

Archiving 256

Archiving File names Security Access 256