CatalogLOOBins

ORCHARD · Tool

funzip

1 techniquemacOSLOOBinsGPL-3.0

extracts a ZIP or gzip file directly to output from archives or other piped input

ExecutionmacOS

funzip is a macOS utility used to extract ZIP or gzip files directly to output. Malicious binaries misuse funzip, along with head or tail, to extract and reconstruct password-protected malicious payloads.

tail -c <> $0 | funzip  -<password>
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Execution
Detection
No detections at time of publishing: No detections at time of publishing