H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

Expand

[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)

Labels

tool
3 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Lateral Tool Transfer
Technique
uses
to NTFS File Attributes
Technique
3 external

References

mitre-attack
S0361
open
Microsoft Expand Utility
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand
open
Palo Alto Networks BBSRAT
http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance