AssemblyLine – Decompressing CaRT Files, Download Submission

What is CaRT

AssemblyLine – Decompressing CaRT Files: AssemblyLine uses CaRT compression for submitted files by default. CaRT is Compressed and RC4 Transport. Basically, it is like zip compressed file that helps you move malware around, without antivirus alerting and preventing malware execution.

AssemblyLine – Downloading Sile Submission

To download submission:

. Left Panel => [Submissions] => Select a submission
    . Go to the bottom "Files" section where all the files are present.
    . Click the file / object you want to obtain
    . On the top right corner click the [Download File] button.

A file with “*.cart” extension will be downloaded to your computer.

AssemblyLine – Decompressing / Extracting CaRT Files

1. Download Python 3 and Install it.
2. Install CaRT module with pip command:

pip install cart

3. Extract the file:

cart SHA256FileHash.cart

AssemblyLine Submission Compression Settings

The CaRT compression settings are per user. Meaning that they can be changed only for your user and not globally from the GUI. CaRT compression is enabled by default (not recommended to disable). To disable compression:
1. Top Right corner, click on your user’s icon.
2. Follow these steps:

"User Menu" => [Settings]
    "Interface Options"
        File encoding: No encoding

Leave a Comment

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.