Technical intelligence and weaponization dossier for CVE-2023-38831. Documented exploitation across 6 active malware families totaling 2,458 analyzed telemetry samples.
| Vulnerability ID | CVE-2023-38831 |
|---|---|
| Common Name / Bulletin | WinRAR File Extension Spoofing Remote Code Execution Vulnerability (RARLAB Security Notice) |
| CWE Classification | CWE-94: Improper Control of Generation of Code in WinRAR |
| Affected Software & Versions | WinRAR versions prior to 6.23 |
| Technical Root Cause | Logic vulnerability in WinRAR when opening file archives containing a decoy file and folder with identical names. When clicking the decoy, WinRAR executed an executable inside the adjacent folder. Exploited zero-day by Qbot and DarkGate. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 6 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| qbot | Banking Trojan | 1,758 | QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2... |
| lockbit | Ransomware | 340 | LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity... |
| redline | Infostealer | 120 | RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful infor... |
| raccoon | Infostealer | 110 | Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerge... |
| lumma | Infostealer | 85 | Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in la... |
| stealc | Infostealer | 45 | Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining ado... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-38831 in enterprise networks:
WinRAR.exe extracting and executing files from %TEMP% directory with trailing space characters or identical file-and-folder name pairs.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →