This software seems to good (and nasty) to be true. I'm aware of other options of hiding files like NTFS streams but to join multiple files and have them all execute at the same time, it seems suspicious, devious and makes me feel like the internet is one notch less secure than it was before. Anyone know how software like these work and how common these things are used in practice?
On a fundamental level, this kind of tool is not at all different from a self-extracting archive (SFX). All it does is compress some files and include them as resources to an executable that will decompress them and then run one or more of the files. This exact same functionality is available in common tools like 7-zip and WinRAR, and it's how installers work on a basic level.
The only thing different about this product is that the self-extractor (the executable part that extracts the other files) is designed to be undetectable, while normal SFXs will show a dialog when they run indicating the decompression, and are designed so that even when the contents are encrypted they are recognizable as SFX. This is the only way that this product differs from a standard SFX system.
So, the functionality is not new or malware-specific at all. What is malware-specific is that it's designed to be hidden like that. Even so, before intelligent users this is still not a very effective way to distribute malware. Although the file could be given an arbitrary icon and name, it must be an executable file and be marked as such, so this tool just reiterates that you should never run shady executables.
When you use this in malware, the vector is like this: you email (or otherwise distribute, most often email) a file called
This can be avoided by users being diligent about files they run. Remember to see what kind of file something actually is, especially if you have file extensions turned off (I always change settings to show file extensions). In recent Windows versions (Vista and 7) most trojans require administrative privileges, so to be effective
Sounds like what malware writers use! Simple answer, It is a container with a script that executes or opens all the files inside the container. Common for software package installers, they have been around a long time, but this one has some special features.
I could see someone putting a few thousand small text documents in one of these, have fun watching when your co-worker opens it. Not as much fun as a ZIP Bomb.
Like anything else in this world, it can be used for Good, Fun or Evil!
Looks like a fun toy. A Must have in my book.
After reading the purchase page it appears to be used for evil purposes!
They accept anonymous cash payments also
Then there is the sister site, selling keyloggers as parental control software, Muhahahaha!