WinRAR SFX archives can run PowerShell without being detected


Level 37
Thread author
Top Poster
Feb 4, 2016
Hackers are adding malicious functionality to WinRAR self-extracting archives that contain harmless decoy files, allowing them to plant backdoors without triggering the security agent on the target system.

Self-extracting archives (SFX) created with compression software like WinRAR or 7-Zip are essentially executables that contain archived data along with a built-in decompression stub (the code for unpacking the data). SFX files can be password-protected to prevent unauthorized access.

The purpose of SFX files is to simplify distribution of archived data to users that do not have a utility to extract the package.

Researchers at cybersecurity company CrowdStrike spotted the SFX abuse during a recent incident response investigation.

SFX attacks in the wild​

Crowdstrike's analysis discovered an adversary that used stolen credentials to abuse 'utilman.exe' and set it to launch a password-protected SFX file that had been planted on the system previously.
Utilman is an accessibility application that can be executed before user login, often abused by hackers to bypass system authentication.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.