sublimehighRule

Attachment: Archive with embedded EXE file

Recursively scans files and archives to detect embedded EXE files (with an MZ header). According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation". The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_type == "rar"
        )
        and any(file.explode(.),
                // the YARA scanner alone can be a bit unreliable,
                // it's matched on MZ strings in a text file before
                any(.flavors.yara, . == "mz_file")
                and strings.starts_with(.flavors.mime, "application")
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

https://therecord.media/ukraine-warns-of-massive-russian-spear-phishing-campaign/

Raw Content

name: "Attachment: Archive with embedded EXE file"
description: |
  Recursively scans files and archives to detect embedded EXE files (with an MZ header).

  According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an 
  attack that used this technique to the "special services of the Russian Federation".

  The spear-phishing operation urged recipients to download a RAR archive included in the 
  email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe)
  that tried to pass as a PDF file.
references:
  - "https://therecord.media/ukraine-warns-of-massive-russian-spear-phishing-campaign/"
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ $file_extensions_common_archives
            or .file_type == "rar"
          )
          and any(file.explode(.),
                  // the YARA scanner alone can be a bit unreliable,
                  // it's matched on MZ strings in a text file before
                  any(.flavors.yara, . == "mz_file")
                  and strings.starts_with(.flavors.mime, "application")
          )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "YARA"
id: "e2b0ad86-1264-567e-b7c4-78d7ddbe7722"