Specially Crafted ZIP Files Used to Bypass Secure Email Gateways

guest · Nov 7, 2019

Specially Crafted ZIP Files Used to Bypass Secure Email Gateways
An oddly formatted ZIP archive hiding the NanoCore malware
November 7, 2019
https://www.bleepingcomputer.com/ne...p-files-used-to-bypass-secure-email-gateways/

Attackers are always looking for new tricks to distribute malware without them being detected by antivirus scanners and secure email gateways. This was illustrated in a new phishing campaign that utilized a specially crafted ZIP file that was designed to bypass secure email gateways to distribute the NanoCore RAT.

When examining the file, the TrustWave researchers discovered that the ZIP archive contained two distinct archive structures, each marked by their own EOCD record.
As we said previously, a ZIP archive should have only one EOCD record, so this indicated that the ZIP file was specially crafted to contain two archive structures.

It was determined that the attackers were creating this specially crafted ZIP archive in order to bypass secure email gateways whose archiving utilities may not properly extract the malware and would only see the harmless decoy image file.
Click to expand...

Different file extractors behave differently
When BleepingComputer tested with 7-Zip 9.20, [...] was able to extract a file. [...] not the malicious payload, but the harmless order.jpg image file.
WinRAR, though, issued no warnings [...] extracted the SHIPPING_MX00034900_PL_INV_pdf.exe NanoCore file.

After testing numerous file extractors, TrustWave determined that only certain versions of the PowerArchiver, WinRar, and older 7-Zip utilities properly extracted the NanoCore executable.
This shows that while this technique may help to bypass email scanners, it also has the side-effect of making it difficult to extract the malicious payload. This would lead to far fewer infected victims than the attacker may have anticipated.
Click to expand...

SpiderLabs Blog: Double Loaded Zip File Delivers Nanocore

Log in or Sign up

Specially Crafted ZIP Files Used to Bypass Secure Email Gateways

guest Guest

Log in or Sign up

Specially Crafted ZIP Files Used to Bypass Secure Email Gateways

guest Guest

Useful Searches