Connect with our team of offensive security, AI security and pen testing experts at Black Hat Europe 2023. Learn More

Connect with our team of offensive security, AI security and pen testing experts at Black Hat Europe 2023. Learn More

Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

Managed Security Services

Expand your team’s capabilities and strengthen your security posture

Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

Penetration Testing

Subscription- or project-based testing, delivered by global experts

Database Security

Get ahead of database risk, protect data and exceed compliance requirements

Email Security & Management

Catch email threats others miss with layered security & maximum control

Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Image File Trickery Part II: Fake Icon Delivers NanoCore

The .zipx file extension is used to denote that the ZIP archive format is compressed using advanced methods of the WinZip archiver. In 2019, we published a blog about this file extension being abused to deliver Lokibot malware. In this blog, we outline another .zipx attachment we recently encountered with spam messages, and we will show the result of our investigation in comparison to the previous .zipx sample we observed.

Figure 1
Figure 1: The email sample containing a .zipx attachment


The emails, claiming to be from the Purchase Manager of certain organizations that the cybercriminals are spoofing, look like usual malspams except for their attachment. The attachments, which have a filename format “NEW PURCHASE ORDER.pdf*.zipx”, are actually image (Icon) binary files, with attached extra data, which happens to be RAR. This file format abuse is similar to what we have seen previously.

Figure 2
Figure 2: The attachment’s contents viewed in the Hiew tool


If the attachment successfully evades any scanning email gateways, the next hurdle is the victim’s machine, which needs to have an unzip tool that can extract the executable file inside the attachment. We tried using the same tools from the previous blog to extract the EXE file and here is the result:



The archive utility WinZip and WinRAR yield similar results when extracting the EXE file from the previous and current .zipx files. WinZip does not support unzipping either of samples whereas WinRAR managed to extract the EXE file contained in both samples.

Figure 3
Figure 3: The executable contained in the attachment NEW PURCHASE ORDER.pdf.zipx is recognized by WinRAR


Interestingly, 7Zip can also extract the content of the latest .zipx sample. 7Zip initially tries to open the files as a ZIP archive and fails, but afterward, 7Zip recognizes the .zipx files as Rar5 archives and can get their contents unpacked. Unlike in the previous blog, there is no need for the extension of the recent attachments to be renamed to something else other than .zipx or .zip just for their executables to be extracted using 7Zip.

Figure 4
Figure 4: Opening the attachment NEW PURCHASE ORDER.pdf.zipx using the 7Zip tool


The executables we gathered have a similar name to that of the .zipx attachment, “NEW PURCHASE ORDER*.exe”. Also, the icon at the start of the .zipx files is actually the icon used on the EXE files within the archive.

Analyzing the EXE files indicates that they are samples of NanoCore RAT version This RAT create copies of itself at the AppData folder and inject its malicious code at RegSvcs.exe process. The data stolen by this RAT is sent to the command and control servers listed below:

  • shtf[.]pw
  • uyeco[.]pw
Figure 5
Figure 5: Memory dump of RegSvcs processes where NanoCore malware is injected



The recent malspams have the same goal like the ones we investigated almost two years ago and that is to effectively hide the malicious executable from anti-malware and email scanners by abusing the file format of the “.zipx” attachment, which in this case is an Icon file with added surprises. In a slight twist, enclosing the executable into a RAR archive instead of a ZIP file, the content of the .zipx attachment can be extracted by another popular archiving tool, 7Zip. If the end-user uses 7Zip or WinRAR, the NanoCore malware could be installed onto the system, if the user decides to run and extract it. It all works because various archive utilities try their darndest to find something to unzip within files. You might even argue they try too hard!

The Trustwave Secure Email Gateway flagged the messages as malicious and detected this threat.



NEW PURCHASE ORDER.pdf.zipx (480092 bytes) SHA1: DF46A893B51D8ADE0CCDEF7E375FB387E2560720
New Purchase Order.pdf (2).zipx (403050 bytes) SHA1: C93FBA54357E90235202F58DA1FEFF7AB1142F65

NanoCore RAT:

NEW PURCHASE ORDER.exe (635904 bytes) SHA1: E99F6B9BD787679666F8C54B9A834D6ACECFA622
New purchase order (3).exe (431104 bytes) SHA1: FD958C365B6BFA5EF34779831773EC92C041A5D5

Latest SpiderLabs Blogs

The 2023 Retail Services Sector Threat Landscape: A Trustwave Threat Intelligence Briefing

The annual holiday shopping season is poised for a surge in spending, a fact well-known to retailers, consumers, and cybercriminals alike. The latter group, however, is poised to exploit any...

Read More

Pwning Electroencephalogram (EEG) Medical Devices by Default

Overall Analysis of Vulnerability Identification – Default Credentials Leading to Remote Code Execution During internal network testing, a document was discovered titled the “XL Security Site...

Read More

Hidden Data Exfiltration Using Time, Literally

I was looking at my watch last week and my attention was moved towards the seconds over at the right of the watch face, incrementing nicely along as you’d expect. Now, I don’t know if I’d just spent...

Read More