1. Home
  2. Techniques
  3. Enterprise
  4. Obfuscated Files or Information
  5. Compression

Obfuscated Files or Information: Compression

ID Name
T1027.001 Binary Padding
T1027.002 Software Packing
T1027.003 Steganography
T1027.004 Compile After Delivery
T1027.005 Indicator Removal from Tools
T1027.006 HTML Smuggling
T1027.007 Dynamic API Resolution
T1027.008 Stripped Payloads
T1027.009 Embedded Payloads
T1027.010 Command Obfuscation
T1027.011 Fileless Storage
T1027.012 LNK Icon Smuggling
T1027.013 Encrypted/Encoded File
T1027.014 Polymorphic Code
T1027.015 Compression
T1027.016 Junk Code Insertion
T1027.017 SVG Smuggling

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).[1]

In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.[2]

File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File).[3] However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.[4]

Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.

ID: T1027.015
Sub-technique of:  T1027
ⓘ
Tactic: Defense Evasion
ⓘ
Platforms: Linux, Windows, macOS
Contributors: Fernando Bacchin
Version: 1.0
Created: 04 March 2025
Last Modified: 15 April 2025
Version Permalink

Procedure Examples

ID Name Description
S1081 BADHATCH

BADHATCH can be compressed with the ApLib algorithm.[5]
S0673 DarkWatchman

DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.[6]
S0695 Donut

Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.[7]
S0666 Gelsemium

Gelsemium has the ability to compress its components.[8]
S0499 Hancitor

Hancitor has delivered compressed payloads in ZIP files to victims.[9]
S0697 HermeticWiper

HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.[10][11][12]
G0126 Higaisa

Higaisa used Base64 encoded compressed payloads.[13][14]
S0585 Kerrdown

Kerrdown can encrypt, encode, and compress multiple layers of shellcode.[15]
G0065 Leviathan

Leviathan has obfuscated code using gzip compression.[16]
S1188 Line Runner

Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.[17]
G0103 Mofang

Mofang has compressed the ShimRat executable within malicious email attachments.[18]
G0021 Molerats

Molerats has delivered compressed executables within ZIP files to victims.[19]
S1100 Ninja

Ninja has compressed its data with the LZSS algorithm.[20][21]
S0664 Pandora

Pandora has the ability to compress stings with QuickLZ.[22]
S1050 PcShare

PcShare has been compressed with LZW algorithm.[23]
S0517 Pillowmint

Pillowmint has been compressed and stored within a registry key.[1]

S0453 Pony

Pony attachments have been delivered via compressed archive files.[24]
S0662 RCSession

RCSession can compress and obfuscate its strings to evade detection on a compromised host.[25]
S0148 RTM

RTM has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.[26][27]
S1099 Samurai

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.[20]
S0444 ShimRat

ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.[18]
S1124 SocGholish

The SocGholish JavaScript payload has been delivered within a compressed ZIP archive.[28][29]

S1183 StrelaStealer

StrelaStealer has been delivered via JScript files in a ZIP archive.[30][31]

S0559 SUNBURST

SUNBURST strings were compressed and encoded in Base64.[32]
G1018 TA2541

TA2541 has used compressed and char-encoded scripts in operations.[33]
G0027 Threat Group-3390

Threat Group-3390 malware is compressed with LZNT1 compression.[34][35][36]
S0665 ThreatNeedle

ThreatNeedle has been compressed and obfuscated.[37]
S0466 WindTail

WindTail can be delivered as a compressed, encrypted, and encoded payload.[38]
S0141 Winnti for Windows

Winnti for Windows has the ability to encrypt and compress its payload.[39]

Mitigations

ID Mitigation Description
M1049 Antivirus/Antimalware

Anti-virus can be used to automatically detect and quarantine suspicious files. Consider anti-virus products capable of unpacking and inspecting compressed files recursively, as well as analyzing SFX archives.

Detection

ID Data Source Data Component Detects
DS0022 File File Creation

Monitor for files with large entropy which don’t match what is normal/expected given the file type and location.
File Metadata

Monitor data about archive files, such as the signatures and the filenames inside of ZIP archives. Files which contain content with large entropy may indicate potentially malicious compressed data.

References

  1. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  2. Arthur Vaiselbuh, Peleg Cabra. (2024, November 7). Evasive ZIP Concatenation: Trojan Targets Windows Users. Retrieved March 3, 2025.
  3. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  4. Ravie Lakshmanan. (2023, April 5). Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks. Retrieved March 3, 2025.
  5. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.
  6. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  7. TheWover. (2019, May 9). donut. Retrieved March 25, 2022.
  8. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  9. Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.
  10. Symantec Threat Hunter Team. (2022, February 24). Ukraine: Disk-wiping Attacks Precede Russian Invasion. Retrieved March 25, 2022.
  11. Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.
  12. Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.
  13. Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.
  14. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  15. Ray, V. and Hayashi, K. (2019, February 1). Tracking OceanLotus’ new Downloader, KerrDown. Retrieved October 1, 2021.
  16. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  17. Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.
  18. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  19. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  20. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  1. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
  2. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
  3. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  4. hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.
  5. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  6. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  7. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  8. Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024.
  9. Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.
  10. Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya & Vishwa Thothathri, Palo Alto Networks. (2024, March 22). Large-Scale StrelaStealer Campaign in Early 2024. Retrieved December 31, 2024.
  11. Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.
  12. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  13. Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.
  14. Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
  15. Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018.
  16. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  17. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.
  18. Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
  19. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.