Expand

MITRE ATT&CK: S0361 View on attack.mitre.org

Aliases: Expand

Malware type
loader
Operating systems
windows
Profile updated
2026-07-07 15:30:00

Context

Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.

Detection coverage

  • 40 Sigma rules

Malware & tools used

  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Lateral Tool Transfer (attack-pattern)
  • NTFS File Attributes (attack-pattern)

Reports & references

  • researchcenter.paloaltonetworks.com — Bbsrat Attacks Targeting Russian Organizations Linked To Roaming Tiger (report)
  • MITRE ATT&CK — S0361 (report)
  • Microsoft — Expand (report)

External references