Check for creation dates, original filenames, and any digital signatures.
This section covers information about the file without actually executing it: Victoria Bravo.rar
Details of what happens when the file is opened in a controlled sandbox: Check for creation dates, original filenames, and any
Does it attempt to connect to a Command and Control (C2) server? Look for suspicious IP addresses or DNS requests. Check for creation dates
Advice on updating antivirus signatures or blocking .rar attachments in email gateways.
Note if it creates "persistence" by adding itself to the Windows Registry startup keys or moving files to C:\Users\...\AppData . 4. Indicators of Compromise (IOCs)
Record the MD5 , SHA-1 , and SHA-256 hashes to uniquely identify the file.