.. / Zipfldr.dll
Star

Compressed Folder library


Paths:


Resources:
https://twitter.com/moriarty_meng/status/977848311603380224
https://twitter.com/bohops/status/997896811904929792
https://windows10dll.nirsoft.net/zipfldr_dll.html

Acknowledgement:
Moriarty (Execution) - @moriarty_meng
r0lan (Obfuscation) - @r0lan


Detection:



Execute

Launch an executable payload by calling RouteTheCall.
rundll32.exe zipfldr.dll,RouteTheCall calc.exe
Usecase:
Privileges required:User
OS:Windows
Mitre:T1085



Launch an executable payload by calling RouteTheCall (obfuscated).
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Usecase:
Privileges required:User
OS:Windows
Mitre:T1085