Archives are everywhere in normal work, which is exactly why attackers use them. A compressed file can hide a payload from scanners, and some tricks make the file look like something it is not.
MITRE tracks this as Compression, technique T1027.015, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Compressed formats such as ZIP, gzip, 7z and RAR bundle several files together. Adversaries use them to obfuscate payloads. MITRE also notes shellcode itself can be compressed, for example to store it in a Windows Registry key, which links to fileless storage.
Two specific tricks from MITRE:
- Concatenated ZIP files. Several ZIP files are joined into one archive. It looks like a single archive but contains the central directories of the embedded ones. Some readers, 7zip among them, may not see the extra content and miss the payload.
- Self-extracting archives. Tools such as 7zip can produce archives that unpack and launch themselves, hiding the payload's function and removing the need for several user actions.
Archives often arrive as a spearphishing attachment so the user extracts the payload. They are often combined with encryption and a password.
How to detect it
MITRE's strategy (DET0281) has one analytic per platform family:
- Windows. Compression tools such as 7zip, WinRAR or MakeCab used around file changes, suspicious file types such as .exe and .dll being compressed, or self-extracting archives dropping files that run right away.
- Linux. gzip, tar, zip or 7z followed by execution of what was unpacked, especially in temp or non-standard locations such as /dev/shm or /tmp, with ELF binaries.
- macOS. Tools such as ditto, unzip, xar or pkgutil extracting to unusual paths, then execution or permission changes such as chmod +x, and processes spawning from that location.
How to reduce the risk
MITRE lists one mitigation: antivirus and antimalware. Choose products that unpack and inspect compressed files recursively and can analyze self-extracting archives.
Test that claim in your own environment. Ask your vendor whether concatenated archives and nested archives are opened, and whether a password protected archive is flagged rather than silently passed.
Quick check
How can concatenated ZIP files hide a payload?
The joined file looks like one archive but holds the central directories of several. Some readers show only part of it, so the embedded payload can be missed.
Sources
- MITRE ATT&CK, Compression (T1027.015)
