File name:

Re-LoaderByR@1n v3.rar

Full analysis: https://app.any.run/tasks/865d54ea-2fb6-4365-85ec-d8e70916b34b
Verdict: Malicious activity
Analysis date: October 09, 2023, 01:50:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

D5A47BE16FDD931F9CF1E95331E6B257

SHA1:

F2B198529ED5EE09FB29905216C344AB90C96DC8

SHA256:

4E7681BD96CE66B8984F03F10A4B328C888ABD2147C2CB0476F1EF129A009344

SSDEEP:

98304:OTekgA4JLfliiPVKADkYty1SOsV5kKqtQwXJd4i0AEE58zv1BNP12MDbAr5KfYXX:Tq+6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Re-LoaderByR@1n v3.exe (PID: 3160)
      • Re-LoaderByR@1n v3.exe (PID: 3736)
      • Re-LoaderByR@1n v3.exe (PID: 3104)
      • Re-LoaderByR@1n v3.exe (PID: 3140)
      • Re-LoaderByR@1n v3.exe (PID: 3400)
      • Re-LoaderByR@1n v3.exe (PID: 2476)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Re-LoaderByR@1n v3.exe (PID: 3736)

  • INFO

    • Checks supported languages

      • Re-LoaderByR@1n v3.exe (PID: 3736)
      • Re-LoaderByR@1n v3.exe (PID: 2476)
      • Re-LoaderByR@1n v3.exe (PID: 3400)

    • Reads the computer name

      • Re-LoaderByR@1n v3.exe (PID: 3736)
      • Re-LoaderByR@1n v3.exe (PID: 2476)
      • Re-LoaderByR@1n v3.exe (PID: 3400)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3820)

    • Reads the machine GUID from the registry

      • Re-LoaderByR@1n v3.exe (PID: 2476)
      • Re-LoaderByR@1n v3.exe (PID: 3400)
      • Re-LoaderByR@1n v3.exe (PID: 3736)

    • Reads Microsoft Office registry keys

      • Re-LoaderByR@1n v3.exe (PID: 3736)

    • Reads Environment values

      • Re-LoaderByR@1n v3.exe (PID: 3736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 2060396
UncompressedSize: 2291704
OperatingSystem: Win32
ModifyDate: 2016:09:01 11:13:54
PackingMethod: Normal
ArchivedFileName: Re-LoaderByR@1n v3.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start winrar.exe no specs re-loaderbyr@1n v3.exe no specs re-loaderbyr@1n v3.exe re-loaderbyr@1n v3.exe no specs re-loaderbyr@1n v3.exe re-loaderbyr@1n v3.exe no specs re-loaderbyr@1n v3.exe

Process information

PID
CMD
Path
Indicators
Parent process
2476"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.28439\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.28439\Re-LoaderByR@1n v3.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Exit code:
0
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.28439\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
3104"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27508\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27508\Re-LoaderByR@1n v3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.27508\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.28439\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.28439\Re-LoaderByR@1n v3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.28439\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
3160"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27373\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27373\Re-LoaderByR@1n v3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.27373\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
3400"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27508\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27508\Re-LoaderByR@1n v3.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Exit code:
0
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.27508\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\shlwapi.dll
3736"C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27373\Re-LoaderByR@1n v3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27373\Re-LoaderByR@1n v3.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Exit code:
0
Version:
3.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3820.27373\re-loaderbyr@1n v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
3820"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Re-LoaderByR@1n v3.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
2 006
Read events
1 982
Write events
24
Delete events
0

Modification events

(PID) Process:(3820) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3820.28439\Re-LoaderByR@1n v3.exeexecutable
MD5:7A1E364C3663554670ACD14C96EA4352
SHA256:471F4D0F6E14686313FC6C4E213CDE9BD2745DEFF2DD806518CC4C9F3FE0EA60
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27508\Re-LoaderByR@1n v3.exeexecutable
MD5:7A1E364C3663554670ACD14C96EA4352
SHA256:471F4D0F6E14686313FC6C4E213CDE9BD2745DEFF2DD806518CC4C9F3FE0EA60
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3820.27373\Re-LoaderByR@1n v3.exeexecutable
MD5:7A1E364C3663554670ACD14C96EA4352
SHA256:471F4D0F6E14686313FC6C4E213CDE9BD2745DEFF2DD806518CC4C9F3FE0EA60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Re-LoaderByR@1n v3.rar