New Technique Zombie Zip Hide Malware In Zip File

A new technique, Zombie Zip, hides malware in an over-the-top Zip file until the anti-virus goes undetected.

Using a zip-type compressed file to misrepresent malware files is one of the most popular ways for hackers to deceive victims to download, decompress, and install malware. This method, if done correctly, reduces the likelihood of detection by anti-malware tools. But the following methods can be called much more insidious and intelligent than the above methods.

According to a report by the website, Cyber News has mentioned that if malware is detected by using a security vulnerability on a Zip file to hide malware code and evade the detection of malware detection tools such as anti-virus software, which, according to the review, allows the file to be detected by 65 out of 66 anti-viruses. Only one Kingsoft anti-virus can be detected. It is called a very potent method. This method is called Zombie Zip, which changes the data in the header or the header of the Zip file. The Metadata repository is used to describe the tool used to decompress the file, how to decompress the file (Extract) or fix the file (Repair). But by converting the value, the tool understands that the file itself is not an uncompressed file. By changing the value of the Compression Mode to STORED in just one byte, it leads to deceiving the anti-virus tool that this file is a normal file. It is safe. The decompressed file does not have to be decompressed to check. It can be avoided.

Fortunately, the tools for loosening popular files such as 7-Zip, unzip, bsdtar, and Python's zipfile cannot be loosened. This means that victims cannot loosen them and install malware as intended by the hackers behind the attack. But this does not mean that the method is harmless or harmless, because a report by the CERT Coordination Center (CERT / CC), a subunit of Carnegie Mellon University, warns that there are many other loosening tools that can loosen Zombie Zip-type files, even if the upper values are changed. Header followed that approach, allowing hackers to also use the Phishing deception method or the trick method to download and install files with a fake error alert (ClickFix) to send malware in the Zombie Zip file format and successfully install malware on the machine.

The associated vulnerability was coded CVE-2026-0866, but it was later brushed off by a team involved in organizing security vulnerability data, as the vulnerability was predicted to be non-new due to its resemblance to one of the security vulnerabilities that was detected during 2004 (2004) or more than 20 years ago, with the vulnerability listed as being able to let Zip files evade detection from antivirus software with the same method of changing values on Header.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # ZIP