During routine threat research and monitoring of Chinese-language underground distribution channels, our team identified a malicious RAR archive. Specifically, this archive abuses a critical WinRAR directory traversal vulnerability to achieve arbitrary file write and persistence on Windows systems.

To accomplish this, the archive leverages a combination of NTFS Alternate Data Streams (ADS) and directory traversal logic. Consequently, it can drop a malicious batch script directly into the Windows Startup directory. When a user extracts the file using a vulnerable WinRAR version (≤ 7.12), the payload is primed for automatic execution. As a result, the malware runs silently on the next user logon. Furthermore, these types of archives are commonly used for the distribution of malware loaders, credential stealers, and initial access tooling.

While we do not claim direct attribution, the techniques observed in this campaign—particularly the abuse of archive parsing logic and multi-stage loaders—overlap with tradecraft previously seen in Lazarus-linked operations and other advanced persistent threat (APT) campaigns. Therefore, this blog documents the archive structure, vulnerability mechanics, and payload behavior, while also providing evidence of the patched behavior in newer WinRAR versions.