Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).[1]
In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.[2]
File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File).[3] However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.[4]
Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.
| ID | Name | Description |
|---|---|---|
| S1081 | BADHATCH | |
| S0673 | DarkWatchman |
DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.[6] |
| S0695 | Donut |
Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.[7] |
| G0047 | Gamaredon Group |
Gamaredon Group has delivered malicious payloads within compressed archives and zip files. [8] |
| S0666 | Gelsemium | |
| S0499 | Hancitor |
Hancitor has delivered compressed payloads in ZIP files to victims.[10] |
| S0697 | HermeticWiper |
HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.[11][12][13] |
| G0126 | Higaisa | |
| S0585 | Kerrdown |
Kerrdown can encrypt, encode, and compress multiple layers of shellcode.[16] |
| G0065 | Leviathan | |
| S1188 | Line Runner |
Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.[18] |
| G0103 | Mofang |
Mofang has compressed the ShimRat executable within malicious email attachments.[19] |
| G0021 | Molerats |
Molerats has delivered compressed executables within ZIP files to victims.[20] |
| S1100 | Ninja |
Ninja has compressed its data with the LZSS algorithm.[21][22] |
| S0664 | Pandora |
Pandora has the ability to compress stings with QuickLZ.[23] |
| S1050 | PcShare | |
| S0517 | Pillowmint |
Pillowmint has been compressed and stored within a registry key.[1] |
| S0453 | Pony |
Pony attachments have been delivered via compressed archive files.[25] |
| S1228 | PUBLOAD |
PUBLOAD has been delivered as compressed files within ZIP files to victims.[26][27] |
| S0662 | RCSession |
RCSession can compress and obfuscate its strings to evade detection on a compromised host.[28] |
| S0148 | RTM |
RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.[29][30] |
| S1099 | Samurai |
Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.[21] |
| S0444 | ShimRat |
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.[19] |
| S1124 | SocGholish |
The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.[31][32] |
| S1183 | StrelaStealer |
StrelaStealer has been delivered via JScript files in a ZIP archive.[33][34] |
| S0559 | SUNBURST | |
| G1018 | TA2541 |
TA2541 has used compressed and char-encoded scripts in operations.[36] |
| G0027 | Threat Group-3390 |
Threat Group-3390 malware is compressed with LZNT1 compression.[37][38][39] |
| S0665 | ThreatNeedle |
ThreatNeedle has been compressed and obfuscated.[40] |
| S0466 | WindTail |
WindTail can be delivered as a compressed, encrypted, and encoded payload.[41] |
| S0141 | Winnti for Windows |
Winnti for Windows has the ability to encrypt and compress its payload.[42] |
| ID | Mitigation | Description |
|---|---|---|
| M1049 | Antivirus/Antimalware |
Anti-virus can be used to automatically detect and quarantine suspicious files. Consider anti-virus products capable of unpacking and inspecting compressed files recursively, as well as analyzing SFX archives. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0281 | Detection Strategy for Compressed Payload Creation and Execution | AN0782 |
Monitors for compression tool usage (e.g., 7zip, WinRAR, MakeCab) that follows or precedes file modification, suspicious file types (e.g., .exe, .dll) being compressed, or dropped from self-extracting archives followed by immediate execution. |
| AN0783 |
Detects sequential command-line compression utilities (e.g., gzip, tar, zip, 7z) followed by execution of unpacked files, especially in temp directories or under non-standard locations like /dev/shm or /tmp with ELF binaries. |
||
| AN0784 |
Identifies archive utilities (e.g., ditto, unzip, xar, pkgutil) used to extract payloads to non-standard paths, then correlates with execution or file permission changes (e.g., |