File name:

rassvet_loader.exe

Full analysis: https://app.any.run/tasks/bfcb0761-1a44-45ac-a32a-0fdb7354be1a
Verdict: Malicious activity
Analysis date: May 17, 2025, 12:29:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

8477F61BCF8063275D04799E8BCC3933

SHA1:

8772D8ABDA05F0F79D9541A90DBDF739584AC4EC

SHA256:

151D1BB0ACFEA30AE2A60B4C82B1B048EBB09475A6C08EC8A485F3591F0F36D0

SSDEEP:

98304:X/0CD2B/brcfNAnYRO4Y6ZhkDQet54netUjZUj0vWn118Sox2bfDSYFPjc8q+TIL:99zUlFZr881mwe/kiXEBInG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • rassvet_loader.exe (PID: 660)

    • Executable content was dropped or overwritten

      • rassvet_loader.exe (PID: 660)

    • Process drops python dynamic module

      • rassvet_loader.exe (PID: 660)

    • Application launched itself

      • rassvet_loader.exe (PID: 660)

    • Loads Python modules

      • rassvet_loader.exe (PID: 1672)

    • Process drops legitimate windows executable

      • rassvet_loader.exe (PID: 660)

    • Checks for Java to be installed

      • java.exe (PID: 6512)
      • java.exe (PID: 2852)
      • java.exe (PID: 472)
      • java.exe (PID: 6564)
      • java.exe (PID: 5972)
      • java.exe (PID: 1096)

    • Starts CMD.EXE for commands execution

      • rassvet_loader.exe (PID: 1672)

  • INFO

    • The sample compiled with english language support

      • rassvet_loader.exe (PID: 660)

    • Checks supported languages

      • rassvet_loader.exe (PID: 660)
      • rassvet_loader.exe (PID: 1672)
      • java.exe (PID: 6512)
      • java.exe (PID: 2852)
      • java.exe (PID: 472)
      • java.exe (PID: 6564)
      • java.exe (PID: 5972)
      • java.exe (PID: 1096)

    • Reads the computer name

      • rassvet_loader.exe (PID: 660)
      • rassvet_loader.exe (PID: 1672)

    • Create files in a temporary directory

      • rassvet_loader.exe (PID: 660)
      • java.exe (PID: 6512)
      • java.exe (PID: 2852)
      • java.exe (PID: 6564)
      • java.exe (PID: 5972)
      • java.exe (PID: 1096)
      • java.exe (PID: 472)

    • PyInstaller has been detected (YARA)

      • rassvet_loader.exe (PID: 1672)
      • rassvet_loader.exe (PID: 660)

    • Creates files in the program directory

      • java.exe (PID: 6512)

    • Checks proxy server information

      • rassvet_loader.exe (PID: 1672)
      • slui.exe (PID: 3008)

    • Reads the software policy settings

      • slui.exe (PID: 7152)
      • slui.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:16 16:45:16+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 178688
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
206
Monitored processes
76
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
start rassvet_loader.exe conhost.exe no specs rassvet_loader.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs icacls.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs slui.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs java.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472java -Xmx4096M -jar "C:\rassvet reborn\rassvet client.jar"C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_2989500\java.exe—cmd.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
1
Version:
8.0.2710.9
Modules
Images
c:\program files (x86)\common files\oracle\java\javapath_target_2989500\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
660"C:\Users\admin\AppData\Local\Temp\rassvet_loader.exe" C:\Users\admin\AppData\Local\Temp\rassvet_loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rassvet_loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
780C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
812C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
856C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
900C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
960C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
968C:\WINDOWS\system32\cmd.exe /c clsC:\Windows\System32\cmd.exe—rassvet_loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1040C:\WINDOWS\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 047
Read events
3 047
Write events
0
Delete events
0

Modification events

No data
Executable files
62
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_bz2.pydexecutable
MD5:684D656AADA9F7D74F5A5BDCF16D0EDB
SHA256:A5DFB4A663DEF3D2276B88866F6D220F6D30CC777B5D841CF6DBB15C6858017C
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_asyncio.pydexecutable
MD5:56F958EEBBC62305B4BF690D61C78E28
SHA256:50631361EF074BE42D788818AF91D0301D22FA24A970F41F496D8272B92CFE31
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_ctypes.pydexecutable
MD5:29873384E13B0A78EE9857604161514B
SHA256:3CC8500A958CC125809B0467930EBCCE88A09DCC0CEDD7A45FACF3E332F7DB33
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_hashlib.pydexecutable
MD5:3E540EF568215561590DF215801B0F59
SHA256:0ED7A6ED080499BC6C29D7113485A8A61BDBA93087B010FCA67D9B8289CBE6FA
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:F91F7DC238DE2C03DC64AA5D2E3B4E49
SHA256:D3B5273ECCC758493C9CFAC5CC43EA74F08216BB1C195609AB27E9B2A241D8B3
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:19DF2B0F78DC3D8C470E836BAE85E1FF
SHA256:BD9E07BBC62CE82DBC30C23069A17FBFA17F1C26A9C19E50FE754D494E6CD0B1
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_decimal.pydexecutable
MD5:21FCB8E3D4310346A5DC1A216E7E23CA
SHA256:9A0E05274CAD8D90F6BA6BC594261B36BFBDDF4F5CA6846B6367FE6A4E2FDCE4
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_queue.pydexecutable
MD5:CC0F4A77CCFE39EFC8019FA8B74C06D0
SHA256:DEE7D19A9FCAB0DF043DC56F2CDC32F1A2A968AB229679B38B378C61CA0CBA53
660rassvet_loader.exeC:\Users\admin\AppData\Local\Temp\_MEI6602\_multiprocessing.pydexecutable
MD5:807DD90BE59EA971DAC06F3AAB4F2A7E
SHA256:B20DD6F5FAB31476D3D8D7F40CB5AB098117FA5612168C0FF4044945B6156D47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
28
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2340
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.145:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2340
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.145
  • 23.48.23.194
  • 23.48.23.180
  • 23.48.23.193
  • 23.48.23.159
  • 23.48.23.164
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 96.7.128.192
  • 96.7.128.186
  • 23.215.0.132
  • 23.215.0.133
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
login.live.com
  • 20.190.159.130
  • 20.190.159.68
  • 40.126.31.2
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rassvet_loader.exe