File name:

Ratool (Removable Access Tool) 1.4.rar

Full analysis: https://app.any.run/tasks/f3bdafbf-1423-455f-8504-38898fb0162a
Verdict: Malicious activity
Analysis date: May 09, 2025, 02:03:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
autoit
crypto-regex
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7FA6A6E499967365CDCDA978F1E22A83

SHA1:

F22F1DF40A12D60D6CA2895637500729F03D73FD

SHA256:

DB42F06ED165C74FA8CB73C6B757C10167D4A36548E98D6FFEC394CD603B3FAD

SSDEEP:

49152:vaQHFYcpmoEEl+c6ybDHJ6pYNfdK5G+goecE8mkean8KElQ049Mf2+pFkX6k6p2g:NHFPc43H0pKIgbN8T78XB49o7F3k6x1Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • WSDApi.exe (PID: 4464)

    • Create files in the Startup directory

      • Launcher.exe (PID: 4400)

    • Changes the autorun value in the registry

      • Launcher.exe (PID: 4400)

    • Adds path to the Windows Defender exclusion list

      • Launcher.exe (PID: 4400)

    • Changes Windows Defender settings

      • Launcher.exe (PID: 4400)

  • SUSPICIOUS

    • Script adds exclusion path to Windows Defender

      • Launcher.exe (PID: 4400)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2504)

    • Reads security settings of Internet Explorer

      • Ratool.exe (PID: 5548)
      • Windows Services.exe (PID: 4208)
      • Launcher.exe (PID: 4400)

    • The process creates files with name similar to system file names

      • Launcher.exe (PID: 4400)

    • Executable content was dropped or overwritten

      • Launcher.exe (PID: 4400)

    • There is functionality for taking screenshot (YARA)

      • WSDApi.exe (PID: 4464)

    • Creates or modifies Windows services

      • WSDApi.exe (PID: 4464)

    • Found regular expressions for crypto-addresses (YARA)

      • Runtime Explorer.exe (PID: 1164)

    • Starts POWERSHELL.EXE for commands execution

      • Launcher.exe (PID: 4400)

  • INFO

    • Reads the computer name

      • Ratool.exe (PID: 5548)
      • Launcher.exe (PID: 4400)
      • Windows Services.exe (PID: 4208)
      • WSDApi.exe (PID: 4464)
      • Secure System Shell.exe (PID: 1188)
      • Runtime Explorer.exe (PID: 1164)

    • Manual execution by a user

      • Ratool.exe (PID: 5548)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2504)

    • Checks supported languages

      • WSDApi.exe (PID: 4464)
      • Ratool.exe (PID: 5548)
      • Windows Services.exe (PID: 4208)
      • Runtime Explorer.exe (PID: 1164)
      • Secure System Shell.exe (PID: 1188)
      • Launcher.exe (PID: 4400)

    • Reads the machine GUID from the registry

      • Ratool.exe (PID: 5548)
      • Windows Services.exe (PID: 4208)
      • Secure System Shell.exe (PID: 1188)
      • Launcher.exe (PID: 4400)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2504)
      • Launcher.exe (PID: 4400)

    • Process checks computer location settings

      • Ratool.exe (PID: 5548)
      • Launcher.exe (PID: 4400)
      • Windows Services.exe (PID: 4208)

    • Create files in a temporary directory

      • WSDApi.exe (PID: 4464)
      • Runtime Explorer.exe (PID: 1164)

    • Creates files or folders in the user directory

      • Launcher.exe (PID: 4400)

    • Reads mouse settings

      • WSDApi.exe (PID: 4464)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6512)

    • The process uses AutoIt

      • WSDApi.exe (PID: 4464)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 45417
UncompressedSize: 93680
OperatingSystem: Win32
ArchivedFileName: Ratool (Removable Access Tool) 1.4/msacm32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs ratool.exe no specs launcher.exe powershell.exe no specs conhost.exe no specs wsdapi.exe windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1188"C:\Windows\IMF\Secure System Shell.exe" C:\Windows\IMF\Secure System Shell.exe—Windows Services.exe
User:
admin
Integrity Level:
HIGH
Description:
Secure System Shell
Version:
1.0.0.0
Modules
Images
c:\windows\imf\secure system shell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2504"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ratool (Removable Access Tool) 1.4.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4208"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}C:\Windows\IMF\Windows Services.exe—Launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Version:
1.0.0.0
Modules
Images
c:\windows\imf\windows services.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4400"C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\wpnclient\Launcher.exe" C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\wpnclient\Launcher.exe
Ratool.exe
User:
admin
Integrity Level:
HIGH
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\ratool (removable access tool) 1.4\wpnclient\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4464"C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\wpnclient\WSDApi.exe" C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\wpnclient\WSDApi.exe
Ratool.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
HIGH
Description:
Removable Access Tool
Version:
1.4.0.0
Modules
Images
c:\users\admin\desktop\ratool (removable access tool) 1.4\wpnclient\wsdapi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
4988C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5204C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5548"C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\Ratool.exe" C:\Users\admin\Desktop\Ratool (Removable Access Tool) 1.4\Ratool.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\ratool (removable access tool) 1.4\ratool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
15 326
Read events
15 300
Write events
26
Delete events
0

Modification events

(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Ratool (Removable Access Tool) 1.4.rar
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(2504) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
14
Suspicious files
10
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\msacm32.dllexecutable
MD5:67705D9F5CC5B1B5369020DB75A96CCA
SHA256:A81F6C00ABB9F93E087E7CC327152548D48AC41E4E87B641D35DE9EE9C32C428
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\wpnclient\Launcher.exeexecutable
MD5:C6D4C881112022EB30725978ECD7C6EC
SHA256:0D87B9B141A592711C52E7409EC64DE3AB296CDDC890BE761D9AF57CEA381B32
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\Ratool.initext
MD5:1A240EF0C2AE6891B5D5890FD76724BF
SHA256:BDDFA27D086608E0631E3BBCA86E655DDEBF51CA140310E03398ABD6813BC30C
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\wpnclient\LICENCE.datcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\wpnclient\msacm32.dllexecutable
MD5:67705D9F5CC5B1B5369020DB75A96CCA
SHA256:A81F6C00ABB9F93E087E7CC327152548D48AC41E4E87B641D35DE9EE9C32C428
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\sas.dllexecutable
MD5:F202A1A5225453D6053D0B431005A13A
SHA256:8429A26A375E7710D1EB4FEDA01BECB076ECDCD4434C985345DCB4DA1971E266
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\wpnclient\Ionic.Zip.dllexecutable
MD5:F6933BF7CEE0FD6C80CDF207FF15A523
SHA256:17BB0C9BE45289A2BE56A5F5A68EC9891D7792B886E0054BC86D57FE84D01C89
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\Read_me.txttext
MD5:DD943471DB59DA2D0ED51C4C91B63F03
SHA256:DF6C183F66D23E87B33E58ACA1313E6AAE8283D6C259EBA78313177CBCA10603
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\wpnclient\Ratool.initext
MD5:1A240EF0C2AE6891B5D5890FD76724BF
SHA256:BDDFA27D086608E0631E3BBCA86E655DDEBF51CA140310E03398ABD6813BC30C
2504WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2504.2937\Ratool (Removable Access Tool) 1.4\Ratool.exeexecutable
MD5:C3B248ACD1FDFA2B5E01E4F407135278
SHA256:1D7319DB8E286398DB2AF5758BAEF35524FB9DF39D676A1C86E6F5B37DD9A2D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
32
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.132
  • 20.190.160.5
  • 20.190.160.64
  • 40.126.32.134
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ratool (Removable Access Tool) 1.4.rar