Groups > alt.comp.os.windows-10 > #187062

Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

From	"Carlos E.R." <robin_listas@es.invalid>
Newsgroups	alt.comp.os.windows-10, alt.comp.os.windows-11, comp.os.linux.advocacy
Subject	Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection
Date	2025-08-28 23:17 +0200
Message-ID	<vjt6olxgje.ln2@Telcontar.valinor> (permalink)
References	(3 earlier) <108o7f8$10ph7$1@dont-email.me> <108pael$191t5$1@dont-email.me> <108pg25$1ahah$1@dont-email.me> <ta06olxj1s.ln2@Telcontar.valinor> <KrYrQ.82041$KK53.64029@fx44.iad>

Cross-posted to 3 groups.

Show all headers | View raw

On 2025-08-28 15:02, CrudeSausage wrote:
> On 2025-08-28 8:57 a.m., Carlos E.R. wrote:
>> On 2025-08-28 13:54, Paul wrote:
>>> On Thu, 8/28/2025 6:19 AM, Daniel70 wrote:
>>>> On 28/08/2025 10:21 am, Hank Rogers wrote:
>>>>> Lawrence D’Oliveiro wrote on 8/27/2025 6:22 PM:
>>>>>> On Wed, 27 Aug 2025 23:25:34 +0800, Mr. Man-wai Chang wrote:

...

>> The rar compressor is not very useful in Linux. It has features I 
>> like, as error correction, but it can not save all the file 
>> attributes. I don't think it is popular.
>>
>> However, it is possible to get emails with rar attachments. I have got 
>> a few. And there are tools that automatically examine the contents of 
>> emails.
> RAR is usually the compression tool pirates use for their software. For 
> my tastes, 7z is just fine, especially with its encryption capabilities. 
> As far as I know, there are a few open-source programs capable of 
> opening 7z and compressing to that format.

Sure.

But when we are receiving email, it is not our choice what compressor 
will be used.

I did notice, though, on a gmx account, that I got several posts with 
rar attachments with executables in them. Obviously malware of some 
sort. If some unknown sends me a .rar with an .exe inside, it will be 
malware. One plus one is two.

But gmx filters did not detect it, and reporting that got nowhere.


-- 
Cheers, Carlos.

Thread

Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Symon <symon@notice.org> - 2025-08-27 09:14 +0200
  Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Mr. Man-wai Chang" <toylet.toylet@gmail.com> - 2025-08-27 23:25 +0800
    Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-27 23:22 +0000
      Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Hank Rogers <Hank@nospam.invalid> - 2025-08-27 19:21 -0500
        Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 00:41 +0000
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-28 08:45 -0400
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 22:36 +0000
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-29 08:39 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-30 00:16 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Hank Rogers <Hank@nospam.invalid> - 2025-08-29 20:02 -0500
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-30 03:35 +0000
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection pothead <pothead@snakebite.com> - 2025-08-28 15:45 +0000
        Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-28 03:28 -0400
        Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Daniel70 <daniel47@somewhere.someplaceelse> - 2025-08-28 20:19 +1000
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-28 07:54 -0400
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-08-28 14:57 +0200
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-28 09:02 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-08-28 23:17 +0200
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 22:35 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-29 08:38 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-29 10:35 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-29 10:55 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-08-31 02:35 +0200
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-31 01:21 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Char Jackson <none@none.invalid> - 2025-08-31 12:58 -0500
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-31 22:46 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-09-01 02:44 +0200
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-09-01 07:56 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-09-01 14:21 +0200
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Char Jackson <none@none.invalid> - 2025-09-01 16:26 -0500
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 22:34 +0000
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 22:32 +0000
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-28 19:18 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-29 00:50 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-28 22:44 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-29 04:02 +0000
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-29 00:53 -0400
                Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-29 05:31 +0000
        Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-28 08:44 -0400
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection chrisv <chrisv@nospam.invalid> - 2025-08-28 16:30 -0500
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-29 08:35 -0400
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-28 22:29 +0000
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection CrudeSausage <crude@sausa.ge> - 2025-08-29 08:36 -0400
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-30 05:39 +0000
              Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-30 07:25 -0400
          Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Paul <nospam@needed.invalid> - 2025-08-28 19:40 -0400
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection Lawrence D’Oliveiro <ldo@nz.invalid> - 2025-08-29 00:51 +0000
            Re: Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection "Carlos E.R." <robin_listas@es.invalid> - 2025-09-02 12:45 +0200

csiph-web