.. /.Tar

Phishing
Double Click
File Archiver

Contributors:

Adithya - @ravooriadithya

Description:

A TAR file is an archive created by tar, a Unix-based utility used to package files together for backup or distribution purposes. It contains multiple files stored in an uncompressed format along with metadata about the archive. These files are capable of carrying malicious executables inside them. A .tar can contain a malicious executable, but it can not be opened with vanilla Windows. Archiving software like the popular WinZip has to be installed, for the user to be able to open the .tar files/attachments.

OS:

Windows
Linux
Mac

Recommendation:

Common email providers do not block tar attachments but there is little legitimate need for them to be delivered through mail. Block the attachments via email gateway. Also, in case of business need, open each of these file type with care.

Resources:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/another-archive-format-smuggling-malware
https://isc.sans.edu/forums/diary/Malicious+tar+Attachments/24496/

File Samples:

https://otx.alienvault.com/indicator/file/e31107cce2aa0dcf8b8c064efeacad5508c69d29