Loading malware…
Winzipper is a Windows backdoor trojan associated with fake software installer campaigns, particularly trojanized WinRAR downloads distributed through lookalike websites and links promoted on Chinese-language sites. It masquerades as a benign archive or utility application while embedding a multi-stage, heavily obfuscated payload chain designed to evade analysis and file-based detection.
Observed delivery chains bundle a legitimate-looking WinRAR installer with malicious components inside layered archives and self-extracting packages. The malware has been seen using packing, password-protected embedded content, and runtime-only unpacking into memory. This staging approach reduces user suspicion, complicates static analysis, and helps conceal the final payload until execution.
Once installed, Winzipper functions as a hidden backdoor that provides attackers with remote access to the compromised Windows host. Reported capabilities include unauthorized system control, theft of victim data, and installation of additional malware payloads. The malware has also been described as profiling the infected system, including access to Windows profile information, apparently to determine or deploy a payload best suited to the victim environment.
The campaign has primarily targeted users in China seeking unofficial downloads of popular compression software, but the infection pattern presents risk to both consumer and enterprise environments. Its use of fake software distribution, memory-resident execution, and staged payload deployment indicates an emphasis on defense evasion and post-compromise flexibility.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Beware of Fake WinRAR Website That Delivers Malware with WinRAR Installer ... the dangerous Winzipper malware ...
Winzipper is a backdoor trojan that provides attackers with remote access to compromised systems, enables data theft, unauthorized system control, and the installation of additional malware, while masquerading as a legitimate file archive utility.
Chinese-language fake-archiver/fake-installer malware delivered via trojanized installers (e.g., fake WinRAR). It deploys a hidden backdoor enabling remote control, data theft, and installation of additional malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.