Tar Extraction to Public AccountPictures (NarwhalRAT)

Duo Tech@duotech

•updated Jun 17, 2026•0•0•2

Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.