Phishing
File Archiver
Contributors:
Adithya - @ravooriadithya
Description:
Compressed file used to store, or "pack," files on Unix-based machines; incorporates a simple compression algorithm that is used to archive files and save disk space; can be decompressed on a Unix system by typing uncompress filename.z, where "filename.z" is the name of the file to decompress. Z files have mostly been replaced by GNUzip compression, which creates .GZ files. Unix users can use the znew utility to recompress Z files to GZ files. These archive filetypes can be leveraged to distribute malicious files.
OS:
Windows
Linux
Recommendation:
After validating business usage, block the download and execution of Z archive files on email & web gateways, endpoints and whitelist as required.
Resources:
File Samples: