If you have already downloaded this file, do not extract or run the contents.
It often carries RedLine Stealer or Lumina Stealer . These programs are designed to harvest: Saved browser passwords and credit card info. Cryptocurrency wallet data. Session cookies (to bypass Multi-Factor Authentication). System metadata and screenshots. 3. Infection Chain
Once the user extracts and runs the executable inside, it performs an environmental check to see if it's running in a virtual machine (to avoid researchers).
Permanently delete the file and run a full system scan using a reputable engine like Malwarebytes or Microsoft Defender.
It may modify registry keys (e.g., HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ) to ensure it starts every time the computer boots.
Based on common patterns for this specific file signature found on sandboxes like ANY.RUN and VirusTotal :
The .rar archive usually contains an obfuscated .exe or .scr file, sometimes hidden within multiple folders to evade simple scanners.