URL:

https://wiki.vrpirates.club/downloads/rookie/rookie_2.27.2_portable.zip

Full analysis: https://app.any.run/tasks/29f74581-6e3e-4d2a-8fb0-08807245eade
Verdict: Malicious activity
Analysis date: March 29, 2024, 07:01:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5533AEF641D8AFA6641B4A55C2D06D1A

SHA1:

FB5D8A2F892B6D44078C0DDB4834CF162A9CCFDA

SHA256:

03274EBA71372CA48CCFD0FAD0DA1B2E827F1E28EFF3B3A912267A262DC96AB9

SSDEEP:

3:N8dj2UL46K45LqgXkLV:2LL4h40h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 7z.exe (PID: 3172)
      • AndroidSideloader v2.27.2.exe (PID: 3616)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • Reads the Internet Settings

      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • Application launched itself

      • adb.exe (PID: 3108)

    • Reads settings of System Certificates

      • AndroidSideloader v2.27.2.exe (PID: 3616)
      • rclone.exe (PID: 3376)

    • Drops 7-zip archiver for unpacking

      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • Adds/modifies Windows certificates

      • rclone.exe (PID: 3376)
      • AndroidSideloader v2.27.2.exe (PID: 3616)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3956)

    • Manual execution by a user

      • explorer.exe (PID: 2596)
      • WinRAR.exe (PID: 2780)
      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2780)
      • iexplore.exe (PID: 3956)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3956)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2780)

    • Checks supported languages

      • AndroidSideloader v2.27.2.exe (PID: 3616)
      • 7z.exe (PID: 1264)
      • adb.exe (PID: 3808)
      • adb.exe (PID: 3108)
      • 7z.exe (PID: 3172)
      • rclone.exe (PID: 3376)
      • adb.exe (PID: 2912)
      • rclone.exe (PID: 1428)
      • adb.exe (PID: 3464)
      • adb.exe (PID: 3536)
      • adb.exe (PID: 864)
      • 7z.exe (PID: 2228)
      • adb.exe (PID: 2880)

    • Reads the computer name

      • AndroidSideloader v2.27.2.exe (PID: 3616)
      • 7z.exe (PID: 3172)
      • 7z.exe (PID: 1264)
      • adb.exe (PID: 2880)
      • 7z.exe (PID: 2228)
      • rclone.exe (PID: 1428)
      • rclone.exe (PID: 3376)

    • Reads the machine GUID from the registry

      • AndroidSideloader v2.27.2.exe (PID: 3616)
      • rclone.exe (PID: 3376)

    • Create files in a temporary directory

      • adb.exe (PID: 2880)

    • Reads Environment values

      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • Creates files or folders in the user directory

      • AndroidSideloader v2.27.2.exe (PID: 3616)

    • Reads the software policy settings

      • AndroidSideloader v2.27.2.exe (PID: 3616)
      • rclone.exe (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs explorer.exe no specs winrar.exe no specs androidsideloader v2.27.2.exe 7z.exe no specs 7z.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs rclone.exe no specs rclone.exe 7z.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\RSL\platform-tools\adb.exe" shell dumpsys batteryC:\RSL\platform-tools\adb.exe—AndroidSideloader v2.27.2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1264"7z.exe" x "C:\Users\admin\Downloads\rookie_2.27.2_portable\rclone.zip" -y -o"C:\Users\admin\Downloads\rookie_2.27.2_portable" -bsp1C:\Users\admin\Downloads\rookie_2.27.2_portable\7z.exe—AndroidSideloader v2.27.2.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\downloads\rookie_2.27.2_portable\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1428"C:\Users\admin\Downloads\rookie_2.27.2_portable\rclone\rclone.exe" listremotes --config vrp.download.configC:\Users\admin\Downloads\rookie_2.27.2_portable\rclone\rclone.exe—AndroidSideloader v2.27.2.exe
User:
admin
Company:
https://rclone.org
Integrity Level:
MEDIUM
Description:
Rsync for cloud storage
Exit code:
0
Version:
1.62.2
Modules
Images
c:\users\admin\downloads\rookie_2.27.2_portable\rclone\rclone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\rookie_2.27.2_portable.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2228"7z.exe" x "C:\Users\admin\Downloads\rookie_2.27.2_portable\meta.7z" -y -o"C:\Users\admin\Downloads\rookie_2.27.2_portable\meta" -p"gL59VfgPxoHR" -bsp1C:\Users\admin\Downloads\rookie_2.27.2_portable\7z.exe—AndroidSideloader v2.27.2.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\downloads\rookie_2.27.2_portable\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2596"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2780"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\rookie_2.27.2_portable.zip" C:\Users\admin\Downloads\rookie_2.27.2_portable\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2880adb -L tcp:5037 fork-server server --reply-fd 216C:\RSL\platform-tools\adb.exe—adb.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2912"C:\RSL\platform-tools\adb.exe" shell svc usb setFunctions mtp trueC:\RSL\platform-tools\adb.exe—AndroidSideloader v2.27.2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3108"C:\RSL\platform-tools\adb.exe" start-serverC:\RSL\platform-tools\adb.exe—AndroidSideloader v2.27.2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
41 246
Read events
40 990
Write events
199
Delete events
57

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31097254
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
146018770
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31097255
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
17
Suspicious files
11
Text files
3 070
Unknown types
90

Dropped files

PID
Process
Filename
Type
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\78118620D6B8F6CB2909CD29DD8239E9binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\78118620D6B8F6CB2909CD29DD8239E9binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9748296F8EC6A1B83B3A993229E7E102binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9748296F8EC6A1B83B3A993229E7E102binary
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\rookie_2.27.2_portable[1].zipcompressed
MD5:—
SHA256:—
3964iexplore.exeC:\Users\admin\Downloads\rookie_2.27.2_portable.zip.vlj8zqn.partialcompressed
MD5:—
SHA256:—
3956iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF871CDDBA41D8C4DC.TMPbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
28
DNS requests
24
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3964
iexplore.exe
GET
304
23.32.238.219:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92967c53a8c0ec29
unknown
—
—
unknown
3964
iexplore.exe
GET
304
23.32.238.219:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?36ca310eb28aaa33
unknown
—
—
unknown
3964
iexplore.exe
GET
200
104.18.38.233:80
http://zerossl.crt.sectigo.com/ZeroSSLECCDomainSecureSiteCA.crt
unknown
—
—
unknown
3964
iexplore.exe
GET
200
104.18.38.233:80
http://zerossl.crt.sectigo.com/ZeroSSLECCDomainSecureSiteCA.crt
unknown
—
—
unknown
3964
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCECO3bePBuysaUZYeCOq3ZOg%3D
unknown
—
—
unknown
3964
iexplore.exe
GET
200
172.64.149.23:80
http://zerossl.ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQzH%2F4%2F%2FQuEFihPlI1WwH4Dktj2TQQUD2vmS845R672fpAeefAwkZLIX6MCEQClHQmP3r10EbiyayR0kuDT
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ffc3fbc5b315e52
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31055eca6ea3b32e
unknown
—
—
unknown
3956
iexplore.exe
GET
304
23.32.238.169:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?719f0b64dcb4a601
unknown
—
—
unknown
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3964
iexplore.exe
185.247.224.87:443
wiki.vrpirates.club
Flokinet Ltd
SC
unknown
3964
iexplore.exe
23.32.238.219:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3964
iexplore.exe
104.18.38.233:80
zerossl.crt.sectigo.com
CLOUDFLARENET
—
shared
3964
iexplore.exe
172.64.149.23:80
zerossl.crt.sectigo.com
CLOUDFLARENET
US
unknown
3956
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3956
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
wiki.vrpirates.club
  • 185.247.224.87
malicious
ctldl.windowsupdate.com
  • 23.32.238.219
  • 23.32.238.232
  • 23.32.238.226
  • 23.32.238.178
  • 23.32.238.241
  • 23.32.238.201
  • 23.32.238.169
  • 23.32.238.208
whitelisted
zerossl.crt.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.184
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.185
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.186
  • 104.126.37.161
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
zerossl.ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
3964
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
3964
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wiki.vrpirates.club/downloads/rookie/rookie_2.27.2_portable.zip