7-Zip

Someone apparently asked, raised the question, and why would I need this if Windows already supports it? And they're obviously not wrong to ask the question.

Microsoft added native support for additional archive formats, including RAR and 7-Zip, starting with Windows 11's newer archive support.

Windows 11 24H2 officially supports ZIP, RAR, 7Z, and TAR formats directly in Windows.

So the argument basically becomes, why should I install WinRAR when Windows can open the file? And WinRAR's response, in the spirit of the company's social media strategy, amounted to, we have a bag.

There's still legitimate reasons to use dedicated archive software, of course.

Windows built-in support isn't identical to WinRAR.

Microsoft itself notes, for example, that Windows archiving handling doesn't support operations like encrypted compressed files in the same way dedicated applications like WinRAR or 7-Zip do.

WinRAR also supports things like archive compression, archive repair, encryption, split archives, self-extracting archives, more control over compression settings, and obviously the creation of its own RAR format.

Tons of stuff.

Like 7-Zip, Disk Checker, Fan.

The classic games from Windows.

Ah.

The research we're discussing today is titled Fake Installers, Fake Reviews, Fake Services: Real Proxies, Real Victims.

And then at the same time, almost simultaneously within a week or so of each other, there was an article about, uh, 7-Zip malware, which turned out to be what they call proxyware, so its main function was to join residential proxies, and that it was using a lookalike domain called, uh, 7zip.com, and it was showing up in people's searches.

There was a YouTube video that recommended people go to 7zip.com and download it, and in fact, it was this residential proxy malware.

And we went to look at that, and they were the same, you know, infrastructure.

So it was like, this is crazy town, right? Like, how do we have this many domains that are really clear lookalikes to major tech things like 7-Zip, and there were a handful of others, as well as these well-known proxy services that are out there selling things.

And that was where we're like, "Okay, now we have to dig in and, and see whether, whether our, our algorithms are wrong.

Like, do these things not really belong together? Or if they do belong together, wow, this is weird." [chuckles]

Yeah.

Now, finally move to task five, which is installing SysTools EML Viewer and investigating the phishing email.

On the M2 Windows server, uh, open the browser, download the SysTools EML Viewer.zip tool, navigate the, to the Downloads folder, extract the zip file using 7-Zip, run the installer, follow the installation steps, checking both boxes and relevant pages, and click Install.

After installation, click the Continue demo, and then return to the email client.

Click the three dots menu for the phishing email and select Download message.

I-

... you've got quite a few, uh, packages there, like 7-Zip, uh, R-

You know, and honestly, back when I used OpenSUSE, that was their weakness.

Their default repos had a lot fewer packages than, uh, than other distros I've used.