.. /.Z

Phishing
File Archiver

Contributors:

Adithya - @ravooriadithya

Description:

Compressed file used to store, or "pack," files on Unix-based machines; incorporates a simple compression algorithm that is used to archive files and save disk space; can be decompressed on a Unix system by typing uncompress filename.z, where "filename.z" is the name of the file to decompress. Z files have mostly been replaced by GNUzip compression, which creates .GZ files. Unix users can use the znew utility to recompress Z files to GZ files. These archive filetypes can be leveraged to distribute malicious files.

OS:

Windows
Linux

Recommendation:

After validating business usage, block the download and execution of Z archive files on email & web gateways, endpoints and whitelist as required.

Resources:

https://www.trendmicro.com/en_in/research/18/j/same-old-yet-brand-new-new-file-types-emerge-in-malware-spam-attachments.html

File Samples:

a22ede52f14be480dd478fa0aec955b807e4b91a14fbe1b5d46c07bbb5cacccbb - .Z file attachment