RARCVE Lab

Around April 2023, threat actors leveraged a zero-day vulnerability (CVE-2023-38831) in the WinRAR compression tool. These weaponized ZIP files, carriers of various malware families such as DarkMe, GuLoader, and Remcos RAT, were strategically distributed on trading forums. Disguised as enticing content like "Personal Strategies to trade with Bitcoin," the archives, once executed, gave threat actors the capability to control the victim machine. You have a copy of the malicious ZIP file to dissect and understand its functionality.