Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Tools Expand

Expand

Active
TLP:CLEAR Exploitation

Description

Expand is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by BBSRAT to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)

No notes yet. Click "Add Note" to create the first analysis note.
No opinions yet. Be the first to assess this intelligence.

Details

External ID
S0361
Confidence
90%
Platforms
windows
Leaving Threaticon

This link opens an external site that isn't part of the platform.