Expand — Malware Profile

Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.

MITRE ATT&CK techniques (3)

• T1140 Deobfuscate/Decode Files or Information
• T1564.004 NTFS File Attributes
• T1570 Lateral Tool Transfer

Read the full analysis on IntelFusions