WinRAR SFX archives can run PowerShell without being detected

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/winrar-sfx-archives-can-run-powershell-without-being-detected/

Hackers are adding malicious functionality to WinRAR self-extracting archives that contain harmless decoy files, allowing them to plant backdoors without triggering the security agent on the target system.

Self-extracting archives (SFX) created with compression software like WinRAR or 7-Zip are essentially executables that contain archived data along with a built-in decompression stub (the code for unpacking the data). SFX files can be password-protected to prevent unauthorized access.

The purpose of SFX files is to simplify distribution of archived data to users that do not have a utility to extract the package.

Researchers at cybersecurity company CrowdStrike spotted the SFX abuse during a recent incident response investigation.

SFX attacks in the wild​

Crowdstrike's analysis discovered an adversary that used stolen credentials to abuse 'utilman.exe' and set it to launch a password-protected SFX file that had been planted on the system previously.
Utilman is an accessibility application that can be executed before user login, often abused by hackers to bypass system authentication.