EVASIVE ZIP CONCATENATION: TROJAN TARGETS WINDOWS USERS

Summary from the TLDR InfoSec newsletter

Zip Concatenation is where a threat actor concatenates the binary data of two zip files to attempt to hide the malicious content. An attacker creates two zip files - one that contains a benign document and another that contains malware - and then concatenates the two zip files. The attacker then relies upon the victim and any relevant cybersecurity tools only seeing one of the archives and missing the malicious files. This post breaks down a real-world campaign that used zip concatenation to hide a Trojan in a second archive and shows how 7zip would miss the file but Windows Explorer and Winrar would not.