039-ch0c0l0.7z

Once the user extracts and runs the file inside the archive, it executes a script [5].

An file that downloads the final payload from a remote server [4, 6]. Typical Behavior (Infection Chain)

Often identified as AsyncRAT or XWorm . These tools allow attackers to remotely control a victim's computer, log keystrokes, and steal sensitive data [2, 3].

The script often uses "Living off the Land" techniques, utilizing legitimate Windows tools (like powershell.exe or mshta.exe ) to stay undetected by antivirus software [4, 6].