File name:

Client.Windows.rar

Full analysis: https://app.any.run/tasks/cebb6b63-a50e-48d5-a46f-0028f7dc97fe
Verdict: Malicious activity
Analysis date: April 29, 2025, 06:56:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

10AA4AA5ACB60D4C1E80259C6411A574

SHA1:

7C443851C2F178E91361080448AF0DCCEA70340D

SHA256:

8DC7971573F48C18B3146ADB440A44D84CCF66A7083173C89D7F751EC6097BDF

SSDEEP:

98304:aUiyRMBibWRxw08E7u4q+W1D2Wx/BK+jZfehId9gIREPb7fRzFQn7ttm6hjdx12o:VSEM88Fy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2840)

  • SUSPICIOUS

    • Connects to unusual port

      • NetRAT.Client.Windows.exe (PID: 2588)

  • INFO

    • Checks supported languages

      • NetRAT.Client.Windows.exe (PID: 2588)

    • Manual execution by a user

      • NetRAT.Client.Windows.exe (PID: 2588)

    • Reads the computer name

      • NetRAT.Client.Windows.exe (PID: 2588)

    • Reads the machine GUID from the registry

      • NetRAT.Client.Windows.exe (PID: 2588)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2840)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 546340
UncompressedSize: 1263104
OperatingSystem: Win32
ArchivedFileName: NetRAT.Client.Windows.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe netrat.client.windows.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2588"C:\Users\admin\Desktop\NetRAT.Client.Windows.exe" C:\Users\admin\Desktop\NetRAT.Client.Windows.exe
explorer.exe
User:
admin
Company:
UnknownComp
Integrity Level:
MEDIUM
Description:
NetRAT Client
Version:
2025.4.29.10024
Modules
Images
c:\users\admin\desktop\netrat.client.windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2840"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Client.Windows.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 913
Read events
2 891
Write events
22
Delete events
0

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Client.Windows.rar
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2840.10590\NetRAT.Client.Windows.exeexecutable
MD5:D2D3A849A6E739BD75A66743707074ED
SHA256:ECE9348FD02C9A6EBF1E991343865709D06BF488C31BE11113CE6B9DFFACF500
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2840.10590\libssl-3.dllexecutable
MD5:44219E1430D570B42219623DAFE6F721
SHA256:2459B52803E8D6A2A6D93A775A8618966C63265BF88AD8C0F761063783D96551
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2840.10590\libcrypto-3.dllexecutable
MD5:B80B7DE70E5250315EC6947472754EAF
SHA256:503AB52E2E455BB31E6B5D9983BDCEE758DDF3B5F393962F78ACD8420EFED69B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
2
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2588
NetRAT.Client.Windows.exe
147.185.221.27:20358
european-liability.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.14
whitelisted
european-liability.gl.at.ply.gg
  • 147.185.221.27
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
1080
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Client.Windows.rar