[Fzsix]

In case you don't know what I'm talking about, this:



I have a previous thread where I discussed this and was given a few suggestions.  The first was remove the ZoneID of the file which I am unable to do.  I simply can't find that solution anywhere.

Secondly, the old "Password protect the RAR/ZIP" which works for me 99% of the time, however in this situation that will not be viable.

I need to figure this out pretty quick.  The file is being downloaded from my website and there is no space to input "Password: xxx".  +REP to whoever can help me reach a solution to this.  

PS anybody interested in this let me know, going to keep details lowkey (if you catch my drift):

[Takehito Morokuzu]

Make sure the file is FUD. If it isn't, even if you bypass this message, the victims antivirus will alert them.

[Fzsix]

Make sure the file is FUD. If it isn't, even if you bypass this message, the victims antivirus will alert them.

The file is FUD. 0/30+. I'm not a rookie haha this ZoneID shit just baffles me.

[Takehito Morokuzu]

The file is FUD.  0/30+.  I'm not a rookie haha this ZoneID shit just baffles me.

Where are you hosting the rar file?

[CyberStrike]

Browsers add a zoneid on download, so download through something other than a browser, for example target downloads a powershell script which "must be run as administrator" they put in set-executionpolicy unrestricted and runs the script which it in turn displays some fake stuff maybe ascii art downloads and executes a payload. Of course if you want to do other things that works too for example set an exception for exe's maybe turn off defender smartscreen. Lately I have been doing powershell scripts that have a payload in .net from there it compiles and executes on the target machine. All kinds of options. A large batch file with pretty much an entire payload all in hex which is copied to the drive and executed.. options be creative. Powershell downloads don't have a zoneid in their alternate data stream. Heck alternate datastream backdoors happen too.

[05317832892]

As SilentWatch said, ZoneID is an alternative file stream. It is not apart of your file on disk. When the file is downloaded, firefox will add a ZoneID to the file which lets other programs know (smartscreen) that the file comes from the internet and is suspicious. The popup you are seeing is because of bad file/site reputation. This is different from ZoneID. Websites such as pomf.cat and their clones have bad reputation and so downloading harmless .txt files gives such warnings in some browsers. Use a reputed file download site, e.g. Google Drive or Mediafire or Mega.

As for password protecting + distributing the password:



You can still see file names even if there is a password.

[3DES]

As SilentWatch said, ZoneID is an alternative file stream. It is not apart of your file on disk. When the file is downloaded, firefox will add a ZoneID to the file which lets other programs know (smartscreen) that the file comes from the internet and is suspicious. The popup you are seeing is because of bad file/site reputation. This is different from ZoneID. Websites such as pomf.cat and their clones have bad reputation and so downloading harmless .txt files gives such warnings in some browsers. Use a reputed file download site, e.g. Google Drive or Mediafire or Mega.

As for password protecting + distributing the password:



You can still see file names even if there is a password.

Encrypt filenames.

[CyberStrike]

As SilentWatch said, ZoneID is an alternative file stream. It is not apart of your file on disk. When the file is downloaded, firefox will add a ZoneID to the file which lets other programs know (smartscreen) that the file comes from the internet and is suspicious. The popup you are seeing is because of bad file/site reputation. This is different from ZoneID. Websites such as pomf.cat and their clones have bad reputation and so downloading harmless .txt files gives such warnings in some browsers. Use a reputed file download site, e.g. Google Drive or Mediafire or Mega.

As for password protecting + distributing the password:



You can still see file names even if there is a password.

+1 Very true site reputation does matter, nearly all browsers use some form of reputation. It used to be domain fronting was a common thing in engagements although too many of big providers have stopped that.

[05317832892]

Encrypt filenames.

?

OP wanted a way to distribute the password with the archive so surely we don't want to encrypt the file names?

[Fzsix]

Browsers add a zoneid on download, so download through something other than a browser, for example target downloads a powershell script which "must be run as administrator" they put in set-executionpolicy unrestricted and runs the script which it in turn displays some fake stuff maybe ascii art downloads and executes a payload. Of course if you want to do other things that works too for example set an exception for exe's maybe turn off defender smartscreen. Lately I have been doing powershell scripts that have a payload in .net from there it compiles and executes on the target machine. All kinds of options. A large batch file with pretty much an entire payload all in hex which is copied to the drive and executed.. options be creative. Powershell downloads don't have a zoneid in their alternate data stream. Heck alternate datastream backdoors happen too.

?

OP wanted a way to distribute the password with the archive so surely we don't want to encrypt the file names?

Both of you have given a great solution, thank you for your thoughtful replies. Silent, your solution is honestly beyond my skid-ass scope of knowledge but you've tried to help me twice to +rep both of you.

//Closed