Article Details

Hackers now use ZIP file concatenation to evade detection. Hackers are targeting Windows machines using the ZIP file concatenation technique to deliver malicious payloads in compressed archives without security solutions detecting them. The technique exploits the different methods ZIP parsers and archive managers handle concatenated ZIP files. This new trend was spotted by Perception Point, who discovered a a concatentated ZIP archive hiding a trojan while analyzing a phishing attack that lured users with a fake shipping notice. The researchers found that the attachment was disguised as a RAR archive and the malware leveraged the AutoIt scripting language to automate malicious tasks. Hiding malware in “broken” ZIPs The first stage of the attack is the preparation, where the threat actors create two or more separate ZIP archives and hide the malicious payload in one of them, leaving the rest with innocuous content. Next, the separate files are concatenated into one by appending the binary data of one file to the other, merging their contents into one combined ZIP archive. Although the final result appears as one file, it contains multiple ZIP structures, each with its own central directory and end markers. Exploiting ZIP app flaws The next phase of the attack relies on how ZIP parsers handle concatenated archives. Perception Point tested 7zip, WinRAR, and Windows File Explorer to different results: Depending on the app’s behavior, the threat actors may fine-tune their attack, such as hiding the malware in the first or the second ZIP archive of the concatenation. Trying the malicious archive from the attack on 7Zip, Perception Point researchers saw that only a harmless PDF file was shown. Opening it with Windows Explorer, though, revealed the malicious executable. To defend against concatenated ZIP files, Perception Point suggests that users and organizations use security solutions that support recursive unpacking. Generally, emails attaching ZIPs or other archive file types should be treated with suspicion, and filters should be implemented in critical environments to block the related file extensions.