Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

April 5, 2023Rabbi LakshmananEndpoint Security/Malware

New findings from CrowdStrike show that an unknown attacker used a malicious self-extracting archive (SFX) file to attempt to establish persistent backdoor access to a victim’s environment.

SFX files can extract the data contained in the file without the need for specialized software to view the contents of the file. This is achieved by including a decompression stub (a piece of code that is run to decompress the archive).

“However, SFX archive files may harbor hidden malicious functionality that is not immediately apparent to the recipient of the file and may be missed by technology-based detection alone,” said CrowdStrike. Researcher Jai Minton said.

In a case investigated by a cybersecurity firm, credentials to a compromised system were used to run a legitimate Windows accessibility application called Utility Manager (utilman.exe), followed by a password-protected SFX file. was started.

This is done by configuring the debugger (another executable file) in the Windows registry to a specific program (in this case utilman.exe) so that the debugger is automatically started each time the program is started. It will be possible.

Also worth noting is the exploitation of utilman.exe. This is because it can be launched directly from the Windows login screen using the Windows logo key + U keyboard shortcut, which may allow an attacker to set a backdoor via his key in the Image File Execution Options registry.

“A closer look at the SFX archive revealed that it did not contain malware, but instead acted as a password-protected backdoor by abusing WinRAR setup options,” Minton said. explains Mr.

Specifically, this file runs PowerShell (powershell.exe), Command Prompt (cmd.exe), and Task Manager (taskmgr.exe) with NT AUTHORITY\SYSTEM privileges by providing the correct password to the archive. It is designed to

“This kind of attack would likely go undetected by traditional antivirus software that looks for malware within archives (often password-protected) rather than operating from stubs in SFX archive decompression programs.” Minton added.

This isn’t the first time SFX files have been used in attacks as a means of hiding attackers from detection. In September 2022, Kaspersky published his campaign of malware spreading his RedLine Stealer using links to password-protected files.

A month later, the infamous Emotet botnet was observed sending SFX archives. This archive, when opened by a user, automatically extracts his password-protected his second her SFX archive, enters the password, and uses a batch script to extract its contents without user interaction. Run .

To mitigate the threat posed by this attack vector, we recommend analyzing SFX archives with dearchiving software to identify potential scripts or binaries that are configured to extract and execute at runtime. To do.