Identify and execute the Windows command interpreter used by /shared/malware/vlc_install.exe (include its extension).
It will output something even if it's a Windows binary.

💡 Hint: Look for common Windows CLI tools.

The vlc_install.exe executable contains multiple parts or payloads.
They are downloaded by the main binary (the dropper or downloader) to evade detection, use curl -v on the URL of the first stage of our malware.

💡 Hint: Search for HTTP GET requests.

Use the /shared/pyinstall command to install the Python packages installed by the dropper (vlc_install.exe) in the same order as they are originally installed by pip.

💡 Hint: You will need to understand how the dropper works to solve this one. Then run /shared/pyinstall {the_python_packages}

As we told you, vlc_install.exe is actually a dropper whose job is to download multiple payloads.

The first payload is available in /shared/malware/stage1_enc.py.
But as you might notice, it's encoded... Decode it to be able to read the code!

💡 Hint: Have a look at what happens in this file, it actually does the job for you somehow...

Congrats on decrypting the first stage of this malware!

We have discovered an IoC which have been found on a infected machine and made it available to you in /shared/malware/ioc.gif.
It seems to have been generated by our stage 1, could you help us decrypt it?
Interestingly enough, it's a GIF file, but it's different from a 'clean' version of the GIF that we found (prodived in /shared/malware/sanic.gif)...

💡 Hint: Maybe there's something else in the gif file?

Oh no! It seems that the stage3 of our malware activated, the files on one of our servers have been encrypted and the intruders are now asking for a ransom...
Do you think you would be able to write a script to decode the file /shared/malware/passwords.txt.encrypted?

💡 Hint: The key might be different to what you think it is.

Write a yara rule named RotRAT to identify the python stages of this malware, then run yara your_rule.yara -r /shared to test it.

💡 Hint: Your rule can be wide enough to detect specific base64 parts.