24467.rar

: A remote access trojan (RAT) used by the "DarkPink" or "Saaiwc" APT groups [1, 7].

If you are analyzing 24467.rar in a lab environment, look for these common behaviors: 24467.rar

: In the case of 24467.rar , the archive contains a file (e.g., document.pdf ) and a folder with the exact same name ( document.pdf ). Inside that folder is an executable script or malware (e.g., document.pdf .exe ) [2, 6]. : A remote access trojan (RAT) used by