This CMD file is responsible for downloading and running a BAT file. After opening the RAR archive and subsequently accessing the JPG file, it leverages a WinRAR vulnerability ( CVE-2023-38831) to execute a CMD file located within the same name folder.

Within this RAR archive, a JPG image file and a folder bearing a similar name. This technique commences by initiating the download of an RAR archive file from certain websites. The initial infection could potentially originate from people who download explicit images and videos from adult websites or fake adult sites, based on the below filenames. This particular campaign appears to target individuals who engage in viewing/downloading Illicit images and videos, aiming to infect them using various malware types, such as Apanyan Stealer, The Murk-Stealer, and AsyncRAT. This file exploits a WinRAR vulnerability to deliver various malicious payloads to the victim’s system. Furthermore, the Batch file downloads and runs additional malware, including The Murk-Stealer and AsyncRAT, which carry out other malicious activities on the victim’s system.ĬRIL came across a RAR archive file on October 3rd on VirusTotal.The initial Batch script in this stage acts as a downloader to obtain a PowerShell grabber, which is responsible for pilfering sensitive data and then proceeds to fetch Apanyan Stealer.The vulnerability triggers the execution of a CMD file, which initiates the download of a BAT file.

In this malware campaign, Threat Actors (TAs) exploit a vulnerability in WinRAR ( CVE-2023-38831) to distribute their malicious payloads onto the systems of their victims.

Cyble Research and Intelligence Labs (CRIL) encountered a RAR archive file that could propagate through adult websites or fake adult sites, etc.

WinRAR 6.23 download the new for mac