@artikrh amazing challenge… man, I had a blast going through this, getting stuck, then realizing something and getting unstuck… Very nice! Well done!
As a general tip, if you manage to decode the attacker’s commands, try to research a bit the file type and see how you can ‘open’ it 
… there’s no need to ‘extract’ it somehow, you’ll just see it there if you managed to get to that point.