Binary that package existing files into a cabinet (.cab) file
diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Hide data compressed into an Alternate Data Stream.
c:\windows\system32\diantz.exe, c:\windows\syswow64\diantz.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml, IOC: diantz storing data into alternate data streams., IOC: diantz getting a file from a remote machine or the internet.
Tamir Yehuda (@tim8288), Hai Vaknin (@vakninhai)