Tuesday, April 22, 2025
HomeComputer SecurityFirst Malware Campaign Exploits WinRAR ACE vulnerability To Hack Windows Computer

First Malware Campaign Exploits WinRAR ACE vulnerability To Hack Windows Computer

Published on

SIEM as a Service

Follow Us on Google News

Researchers have detected the first malspam campaign that delivers a malicious RAR archive to infect victim’s computer exploiting the WinRAR ACE vulnerability.

The 19-year-old vulnerability was disclosed by checkpoint security researchers last week, the vulnerability resides in the WinRAR UNACEV2.DLL library.

This vulnerability can be exploited by an attacker with specially crafted ACE archive and to extract the file in windows startup folder to gain the persistence and to get launched automatically once the user logged in to the computer.

- Advertisement - Google News

First Malspam Campaign

360 Threat intelligence center detected a malspam campaign that delivers a malcious RAR archive by exploiting this vulnerability.The backdoor is generated MSF and it extracts to user’s startup folder.

Based on analysis the malware fails to execute due to lack of permissions if UAC is running in the machine, the extraction fails with the error “Access is denied” and “operation failed”.

Training Course: Certified Cyber Threat Intelligence Analysts course that we’ll introduce you to the 8 phases of threat intelligence.

If the UAC is disabled or the WinRAR running with the admin privileges then the malware will get extract to the user’s Startup folder C:\ProgramData\Microsoft\Windows\StartMenu\Programs\Startup\CMSTray.exe and it will execute with the user’s next login.

  • The malware gets extracted to CMSTray.exe and it will be launched upon next login
  • Once the malware launched it copies the CMSTray.exe file to %Temp%\wbssrv.exe and the executable get’s executed.
  • Upon execution, it connects with the following 138.204.171.108 and downloads various tools including the including the asynchronous post-exploitation agent Cobalt Strike Beacon.
  • Once the DLL got loaded the attackers able to obtain remote connection over the victim’s machine and run’s various commands.

If you have not yet updated the WinRAR, it’s time to update with the latest version of the WinRAR(WinRAR 5.70 beta 1).

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

TP-Link Router Vulnerabilities Allow Attackers to Execute Malicious SQL Commands

Cybersecurity researchers have uncovered critical SQL injection vulnerabilities in four TP-Link router models, enabling...

Faster Vulnerability Patching Reduces Risk and Lowers Cyber Risk Index

Trend Micro's Cyber Risk Exposure Management (CREM) solution has highlighted the critical role that...

Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks

In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious...

Samsung One UI Vulnerability Leaks Sensitive Data in Plain Text With No Expiration!

A glaring vulnerability has come to light within Samsung's One UI interface: the clipboard...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

TP-Link Router Vulnerabilities Allow Attackers to Execute Malicious SQL Commands

Cybersecurity researchers have uncovered critical SQL injection vulnerabilities in four TP-Link router models, enabling...

Faster Vulnerability Patching Reduces Risk and Lowers Cyber Risk Index

Trend Micro's Cyber Risk Exposure Management (CREM) solution has highlighted the critical role that...

Malicious npm Packages Target Linux Developers with SSH Backdoor Attacks

In a sophisticated onslaught targeting the open-source ecosystem, reports have emerged detailing several malicious...