S0361 Expand

toolEnterprise

platformsWindows

also known asExpand

Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.

techniques used (3)

ATT&CK techniques this enables or maps to.

T1140Deobfuscate/Decode Files or Information
T1564.004NTFS File Attributes
T1570Lateral Tool Transfer

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan