What is CaRT
AssemblyLine – Decompressing CaRT Files: AssemblyLine uses CaRT compression for submitted files by default. CaRT is Compressed and RC4 Transport. Basically, it is like zip compressed file that helps you move malware around, without antivirus alerting and preventing malware execution.
AssemblyLine – Downloading Sile Submission
To download submission:
. Left Panel => [Submissions] => Select a submission . Go to the bottom "Files" section where all the files are present. . Click the file / object you want to obtain . On the top right corner click the [Download File] button.
A file with “*.cart” extension will be downloaded to your computer.
AssemblyLine – Decompressing / Extracting CaRT Files
1. Download Python 3 and Install it.
2. Install CaRT module with pip command:
pip install cart
3. Extract the file:
AssemblyLine Submission Compression Settings
The CaRT compression settings are per user. Meaning that they can be changed only for your user and not globally from the GUI. CaRT compression is enabled by default (not recommended to disable). To disable compression:
1. Top Right corner, click on your user’s icon.
2. Follow these steps:
"User Menu" => [Settings] "Interface Options" File encoding: No encoding