File name:

Client.Windows.rar

Full analysis: https://app.any.run/tasks/592bbde5-397f-4dbb-9646-09b9099b4cc6
Verdict: Malicious activity
Analysis date: April 29, 2025, 06:52:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EC47B5393894CBCEF3E070A1EBA8FFAC

SHA1:

F59E066EFA506FA0118B5B88C5EF1069124D4CF2

SHA256:

0177B18D94D4632874495EDAA5843D8B03CB8DB3993843621A2904A659AACE6C

SSDEEP:

98304:6yjsXQeXKWuraJSSDwgtYbZmln4jwxmxK0gb/SOPe3hHlDUN42e9y4YLQ8woI1mf:jvU19

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2060)

  • SUSPICIOUS

    • Connects to unusual port

      • NetRAT.Client.Windows.exe (PID: 1324)
      • NetRAT.Client.Windows.exe (PID: 1000)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2060)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2060)

    • Checks supported languages

      • NetRAT.Client.Windows.exe (PID: 1324)
      • NetRAT.Client.Windows.exe (PID: 1000)

    • Reads the machine GUID from the registry

      • NetRAT.Client.Windows.exe (PID: 1324)
      • NetRAT.Client.Windows.exe (PID: 1000)

    • Manual execution by a user

      • NetRAT.Client.Windows.exe (PID: 1324)
      • NetRAT.Client.Windows.exe (PID: 1000)

    • Reads the computer name

      • NetRAT.Client.Windows.exe (PID: 1324)
      • NetRAT.Client.Windows.exe (PID: 1000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 545682
UncompressedSize: 1262592
OperatingSystem: Win32
ArchivedFileName: NetRAT.Client.Windows.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe netrat.client.windows.exe svchost.exe netrat.client.windows.exe

Process information

PID
CMD
Path
Indicators
Parent process
1000"C:\Users\admin\Desktop\NetRAT.Client.Windows.exe" C:\Users\admin\Desktop\NetRAT.Client.Windows.exe
explorer.exe
User:
admin
Company:
UnknownComp
Integrity Level:
MEDIUM
Description:
NetRAT Client
Exit code:
3221225786
Version:
2025.4.29.10024
Modules
Images
c:\users\admin\desktop\netrat.client.windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1324"C:\Users\admin\Desktop\NetRAT.Client.Windows.exe" C:\Users\admin\Desktop\NetRAT.Client.Windows.exe
explorer.exe
User:
admin
Company:
UnknownComp
Integrity Level:
MEDIUM
Description:
NetRAT Client
Exit code:
3221225786
Version:
2025.4.29.10024
Modules
Images
c:\users\admin\desktop\netrat.client.windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2060"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Client.Windows.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
3 893
Read events
3 865
Write events
28
Delete events
0

Modification events

(PID) Process:(2060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Client.Windows.rar
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2060.33957\NetRAT.Client.Windows.exeexecutable
MD5:AC670301EBF70407A9F31044B8C6628F
SHA256:79D2F68DAC9BA09C508E6149351C5CFDFCAE30F9738B4694A16379165191BD67
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2060.33957\libcrypto-3.dllexecutable
MD5:B80B7DE70E5250315EC6947472754EAF
SHA256:503AB52E2E455BB31E6B5D9983BDCEE758DDF3B5F393962F78ACD8420EFED69B
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2060.33957\libssl-3.dllexecutable
MD5:44219E1430D570B42219623DAFE6F721
SHA256:2459B52803E8D6A2A6D93A775A8618966C63265BF88AD8C0F761063783D96551
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
2
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1324
NetRAT.Client.Windows.exe
147.185.221.27:20358
european-liability.gl.at.ply.gg
PLAYIT-GG
US
malicious
1000
NetRAT.Client.Windows.exe
147.185.221.27:20358
european-liability.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.208.206
whitelisted
european-liability.gl.at.ply.gg
  • 147.185.221.27
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
1080
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Client.Windows.rar