File name:

AndroidSideloader v2.26.exe

Full analysis: https://app.any.run/tasks/e558c955-2cca-413e-951d-f3b07a4526ec
Verdict: Malicious activity
Analysis date: February 13, 2024, 18:45:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1158E107E5A5FB9BF3AE7BCC8276F429

SHA1:

EA46F63D51C2C8FB641E9C23C5E206E9CA4FBA6D

SHA256:

6278D167AC356CDAD30CD5A8EA37A7522F823515731AB64F4D1271BF38FB9497

SSDEEP:

98304:CcEQQMDXQmfYGBHkBPUHexnMO93WGY+PF:UY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AndroidSideloader v2.26.exe (PID: 3700)
      • 7z.exe (PID: 3784)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Reads the Internet Settings

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Reads settings of System Certificates

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • AndroidSideloader v2.26.exe (PID: 3700)
      • 7z.exe (PID: 3784)

    • Drops 7-zip archiver for unpacking

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Application launched itself

      • adb.exe (PID: 3276)

    • Adds/modifies Windows certificates

      • AndroidSideloader v2.26.exe (PID: 3700)

  • INFO

    • Checks supported languages

      • AndroidSideloader v2.26.exe (PID: 3700)
      • 7z.exe (PID: 3784)
      • 7z.exe (PID: 120)
      • adb.exe (PID: 1696)
      • adb.exe (PID: 3960)
      • rclone.exe (PID: 3516)
      • rclone.exe (PID: 3068)
      • adb.exe (PID: 3276)

    • Reads the machine GUID from the registry

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Reads the computer name

      • AndroidSideloader v2.26.exe (PID: 3700)
      • 7z.exe (PID: 3784)
      • 7z.exe (PID: 120)
      • adb.exe (PID: 3960)
      • rclone.exe (PID: 3516)
      • rclone.exe (PID: 3068)

    • Creates files or folders in the user directory

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Reads the software policy settings

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Reads Environment values

      • AndroidSideloader v2.26.exe (PID: 3700)

    • Create files in a temporary directory

      • AndroidSideloader v2.26.exe (PID: 3700)
      • 7z.exe (PID: 120)
      • adb.exe (PID: 3960)

    • Manual execution by a user

      • explorer.exe (PID: 1900)
      • explorer.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2059:02:11 09:21:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 3800064
InitializedDataSize: 413184
UninitializedDataSize: -
EntryPoint: 0x3a1ade
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.0
ProductVersionNumber: 2.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Rookie Sideloader
CompanyName: Rookie.WTF
FileDescription: AndroidSideloader
FileVersion: 2.0.0.0
InternalName: AndroidSideloader.exe
LegalCopyright: Copyright © 2020
LegalTrademarks: -
OriginalFileName: AndroidSideloader.exe
ProductName: AndroidSideloader
ProductVersion: 2.0.0.0
AssemblyVersion: 2.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start androidsideloader v2.26.exe 7z.exe 7z.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs rclone.exe no specs rclone.exe no specs explorer.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"7z.exe" x "C:\Users\admin\AppData\Local\Temp\rclone.zip" -y -o"C:\Users\admin\AppData\Local\Temp" -bsp1C:\Users\admin\AppData\Local\Temp\7z.exe—AndroidSideloader v2.26.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\appdata\local\temp\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1696"C:\RSL\platform-tools\adb.exe" kill-serverC:\RSL\platform-tools\adb.exe—AndroidSideloader v2.26.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1900"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3068"C:\Users\admin\AppData\Local\Temp\rclone\rclone.exe" cat ":Quest Games/VRP-GameList.txt" --config vrp.download.configC:\Users\admin\AppData\Local\Temp\rclone\rclone.exe—AndroidSideloader v2.26.exe
User:
admin
Company:
https://rclone.org
Integrity Level:
MEDIUM
Description:
Rsync for cloud storage
Exit code:
1
Version:
1.62.2
Modules
Images
c:\users\admin\appdata\local\temp\rclone\rclone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3224"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3276"C:\RSL\platform-tools\adb.exe" start-serverC:\RSL\platform-tools\adb.exe—AndroidSideloader v2.26.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3516"C:\Users\admin\AppData\Local\Temp\rclone\rclone.exe" listremotes --config vrp.download.configC:\Users\admin\AppData\Local\Temp\rclone\rclone.exe—AndroidSideloader v2.26.exe
User:
admin
Company:
https://rclone.org
Integrity Level:
MEDIUM
Description:
Rsync for cloud storage
Exit code:
0
Version:
1.62.2
Modules
Images
c:\users\admin\appdata\local\temp\rclone\rclone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3700"C:\Users\admin\AppData\Local\Temp\AndroidSideloader v2.26.exe" C:\Users\admin\AppData\Local\Temp\AndroidSideloader v2.26.exe
explorer.exe
User:
admin
Company:
Rookie.WTF
Integrity Level:
MEDIUM
Description:
AndroidSideloader
Exit code:
4294967295
Version:
2.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\androidsideloader v2.26.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3784"7z.exe" x "C:\Users\admin\AppData\Local\Temp\_adb.7z" -y -o"C:\RSL\platform-tools" -bsp1C:\Users\admin\AppData\Local\Temp\7z.exe
AndroidSideloader v2.26.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\appdata\local\temp\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3960adb -L tcp:5037 fork-server server --reply-fd 216C:\RSL\platform-tools\adb.exe—adb.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
8 988
Read events
8 952
Write events
35
Delete events
1

Modification events

(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3700) AndroidSideloader v2.26.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AndroidSideloader v2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
16
Suspicious files
21
Text files
1 644
Unknown types
58

Dropped files

PID
Process
Filename
Type
3700AndroidSideloader v2.26.exeC:\Users\admin\AppData\Local\Temp\7z.exeexecutable
MD5:8F57948E69C82BF98704F129C5460576
SHA256:F00836A63BE7EBF14E1B8C40100C59777FE3432506B330927EA1F1B7FD47EE44
3700AndroidSideloader v2.26.exeC:\Users\admin\AppData\Local\Temp\7z.dllexecutable
MD5:AE7DE9A0278F37331D2E9F8D5C0281F0
SHA256:A3FC74468477BA54517157EFA5021EAA6FF72F8F5C31E53D89F07D59071C0AE7
37847z.exeC:\RSL\platform-tools\AdbWinApi.dllexecutable
MD5:ED5A809DC0024D83CBAB4FB9933D598D
SHA256:D60103A5E99BC9888F786EE916F5D6E45493C3247972CB053833803DE7E95CF9
37847z.exeC:\RSL\platform-tools\AdbWinUsbApi.dllexecutable
MD5:0E24119DAF1909E398FA1850B6112077
SHA256:25207C506D29C4E8DCEB61B4BD50E8669BA26012988A43FBF26A890B1E60FC97
37847z.exeC:\RSL\platform-tools\etc1tool.exeexecutable
MD5:29A86ACF93731FA26C2B3AFA6A155B4C
SHA256:4C82EA5A7C50EC482B401AF272FE437AB5861816F10EC8A2584875A853690767
37847z.exeC:\RSL\platform-tools\dmtracedump.exeexecutable
MD5:2CBAAAC5DD49A6C8F57318A04B3FD1DB
SHA256:E57495D334295F42230EADB50E80D8D278FD822554063892001BC78BE829AC93
37847z.exeC:\RSL\platform-tools\fastboot.exeexecutable
MD5:D6F80781D3B23EAA83DCB8468965BB0C
SHA256:B19C076410F644525569AA066CFCA99D3D0647C5F41898EE178C906222648FE2
37847z.exeC:\RSL\platform-tools\hprof-conv.exeexecutable
MD5:77DE62B0B55069FA87FF160438B6D7EB
SHA256:4843B718CB80B5854FBDFE485EFF896A16062A6AE738C6690085C388CAF61C2A
37847z.exeC:\RSL\platform-tools\libwinpthread-1.dllexecutable
MD5:95DECA9CA898F8DAEB3288A06F4A020A
SHA256:6CD4726956F3487453F151B847AFFAD442A81ACFCC4CB816B9BCB5AD5E7B6F7C
37847z.exeC:\RSL\platform-tools\make_f2fs_casefold.exeexecutable
MD5:E1086A2A0F5E3BDCCFCB2F183598D9C0
SHA256:CD334AD72EE383E5F39722E2304CD2C7576B86A8134A33284E1AF7DEB8968337
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
14
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3700
AndroidSideloader v2.26.exe
GET
200
172.64.149.23:80
http://zerossl.crt.sectigo.com/ZeroSSLECCDomainSecureSiteCA.crt
unknown
binary
905 b
unknown
3700
AndroidSideloader v2.26.exe
GET
200
173.222.108.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c41d92d6b09abc02
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3700
AndroidSideloader v2.26.exe
140.82.121.3:443
github.com
GITHUB
US
unknown
3700
AndroidSideloader v2.26.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
unknown
3700
AndroidSideloader v2.26.exe
95.217.6.16:443
downloads.rclone.org
Hetzner Online GmbH
FI
unknown
3700
AndroidSideloader v2.26.exe
173.222.108.147:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3700
AndroidSideloader v2.26.exe
185.247.224.87:443
vrpirates.wiki
Flokinet Ltd
SC
unknown
3700
AndroidSideloader v2.26.exe
172.64.149.23:80
zerossl.crt.sectigo.com
CLOUDFLARENET
US
unknown
1492
svchost.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
downloads.rclone.org
  • 95.217.6.16
unknown
ctldl.windowsupdate.com
  • 173.222.108.147
  • 173.222.108.203
  • 173.222.108.194
  • 173.222.108.249
  • 173.222.108.201
  • 173.222.108.177
  • 173.222.108.210
  • 173.222.108.195
  • 173.222.108.200
whitelisted
vrpirates.wiki
  • 185.247.224.87
unknown
zerossl.crt.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AndroidSideloader v2.26.exe