Expand
- ID
- S0361
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
Expand is a Windows utility used to expand one or more compressed CAB files.[1] It has been used by BBSRAT to decompress a CAB file into executable content.[2]
Techniques used (3)
- T1140 Deobfuscate/Decode Files or Information
- T1564.004 NTFS File Attributes
- T1570 Lateral Tool Transfer