CastleLoader batch: curl Python embed zip saved as .pdf, tar extract, explorer k

Adarsh Pandey@Pandeyadarsh

•updated today•0•0•1

Detects a behavioral sequence on a host involving the download of a Python embeddable zip file masquerading as a PDF via curl, extraction using tar, the termination of explorer.exe using taskkill, and the execution of a numeric-named executable running inline Python code with base64 and zlib decoding.