S0361Windows

S0361Expand

Platforms
1
ATT&CK
14.1
References
3

Description

[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)

Platforms· 1

Windows

References

  1. https://attack.mitre.org/software/S0361
  2. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand
  3. http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Expand.exe
Software
BBSRAT
Software
BoomBox
Software
SDBbot
Technique
Deobfuscate/Decode Files or Information
Software
CARROTBAT
Sourced from MITRE ATT&CK Enterprise 14.1. Curated by Adam Lundqvist, SQUR.