Locked ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms.

This is the hidden content, please

• Sign In
• or
• Sign Up