It is common for businesses to use password-protected SFX archives. Password-Protected SFX Archives Used as Backdoor by Attackers Researchers have discovered that an apparently empty SFX archive file can be risky, too, as it may provide hackers with a persistent backdoor to a victim’s environment when combined with a specific registry key. Security detections may miss hidden malicious functionality within these archives.

SFX archives have been used for legitimate purposes for a long time.

The attack does not require the target user to have WinRAR or any other compression software, as SFX files are designed to grant access to contents to these users as well. Compressor software like WinRAR and 7-Zip use SFX technology to make it easier to distribute software and files.įor SFX, WinRAR provides advanced options like the ability to execute commands both before and after setup and to overwrite any existing files or directories in the target directory. SFX archives involve a decompressor stub allowing users to decompress and view the contents without additional software. Threat actors exploit WinRAR self-extracting (SFX) archives containing decoy files by adding malicious functionality to install backdoors in target systems without detection.

Zip rar