# funzip

> The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.

funzip is a macOS utility that extracts a ZIP or gzip file directly to output from archives or other piped input. The malicious binaries use funzip to extract the malicious binary with a password and using head or tail commands.

- Page: https://loobins.io/binaries/funzip/
- Author: Pratik Jeware
- Created: 2026-01-21
- Tactics: Execution

## Paths

- `/usr/bin/funzip`

## Example Use Cases

### extracts a ZIP or gzip file directly to output from archives or other piped input

funzip is a macOS utility used to extract ZIP or gzip files directly to output. Malicious binaries misuse funzip, along with head or tail, to extract and reconstruct password-protected malicious payloads.

```bash
tail -c <> $0 | funzip  -<password>
```

- Tactics: Execution
- Tags: bash, zsh

## Detections

- No detections at time of publishing

## Resources

- [MacOS: Bashed Apples of Shlayer and Bundlore](https://www.uptycs.com/blog/threat-research-report-team/macos-bashed-apples-of-shlayer-and-bundlore)
- [funzip man page](https://linux.die.net/man/1/funzip)