download:

887Rat-main.rar

Full analysis: https://app.any.run/tasks/9c6c3e0b-bd06-42c3-b229-42739d5f1fee
Verdict: Malicious activity
Analysis date: August 12, 2022, 15:36:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: RecoveryRecordPresent
MD5:

D7D11FB25A956C2DFC55B46A3B91940A

SHA1:

56A2C72BC1C0A38E3AD15FC34CF360BF93A76659

SHA256:

E27CC65C2A28268E8124719D88075AC9E22DB2A99120EDA1D700DB2519AF3C85

SSDEEP:

1572864:Sw2BUF2RxxB2B3EWbR2PG3yVqUSMglchm9yXnNEoNafYH1QChZ0/n6J:8B82RxbyELPGyaRLsXnNnNP1h2n6J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • 887Rat-main.exe (PID: 3132)
      • crack.exe (PID: 1760)
      • 887Rat.exe (PID: 3116)
      • Aut2exe.exe (PID: 2600)
      • AQACVJ.exe (PID: 372)
      • Aut2exe.exe (PID: 1864)

    • Writes to a start menu file

      • crack.exe (PID: 1760)

    • Loads dropped or rewritten executable

      • 887Rat.exe (PID: 3116)

    • Application was dropped or rewritten from another process

      • 887Rat-main.exe (PID: 3132)
      • flagx.exe (PID: 3428)
      • crack.exe (PID: 1760)
      • AQACVJ.exe (PID: 372)
      • exe2msi.exe (PID: 2572)
      • Aut2exe.exe (PID: 1864)
      • Aut2exe.exe (PID: 2600)
      • PNCOMD.exe (PID: 3012)
      • crack.exe (PID: 892)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3532)
      • 887Rat-main.exe (PID: 3132)
      • crack.exe (PID: 1760)
      • 887Rat.exe (PID: 3116)
      • WinRAR.exe (PID: 2248)
      • flagx.exe (PID: 3428)
      • AQACVJ.exe (PID: 372)
      • Aut2exe.exe (PID: 2600)
      • PNCOMD.exe (PID: 3012)
      • crack.exe (PID: 892)
      • Aut2exe.exe (PID: 1864)

    • Checks supported languages

      • WinRAR.exe (PID: 3532)
      • 887Rat-main.exe (PID: 3132)
      • crack.exe (PID: 1760)
      • WinRAR.exe (PID: 2248)
      • flagx.exe (PID: 3428)
      • 887Rat.exe (PID: 3116)
      • AQACVJ.exe (PID: 372)
      • exe2msi.exe (PID: 2572)
      • Aut2exe.exe (PID: 2600)
      • PNCOMD.exe (PID: 3012)
      • crack.exe (PID: 892)
      • Aut2exe.exe (PID: 1864)

    • Reads Microsoft Outlook installation path

      • 887Rat-main.exe (PID: 3132)

    • Reads internet explorer settings

      • 887Rat-main.exe (PID: 3132)

    • Drops a file with a compile date too recent

      • 887Rat-main.exe (PID: 3132)
      • 887Rat.exe (PID: 3116)
      • crack.exe (PID: 1760)
      • Aut2exe.exe (PID: 2600)
      • AQACVJ.exe (PID: 372)
      • Aut2exe.exe (PID: 1864)

    • Executable content was dropped or overwritten

      • crack.exe (PID: 1760)
      • 887Rat-main.exe (PID: 3132)
      • 887Rat.exe (PID: 3116)
      • AQACVJ.exe (PID: 372)
      • Aut2exe.exe (PID: 2600)
      • Aut2exe.exe (PID: 1864)

    • Reads mouse settings

      • 887Rat.exe (PID: 3116)
      • AQACVJ.exe (PID: 372)
      • PNCOMD.exe (PID: 3012)

  • INFO

    • Manual execution by user

      • 887Rat-main.exe (PID: 3132)
      • 887Rat.exe (PID: 3116)
      • WinRAR.exe (PID: 2248)
      • AQACVJ.exe (PID: 372)
      • crack.exe (PID: 892)
      • PNCOMD.exe (PID: 3012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: 887Rat-main\887Rat-main.exe
PackingMethod: Stored
ModifyDate: 2022:06:10 20:38:26
OperatingSystem: Win32
UncompressedSize: 100450172
CompressedSize: 100450225
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
12
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs 887rat-main.exe crack.exe 887rat.exe winrar.exe no specs flagx.exe no specs aut2exe.exe aqacvj.exe exe2msi.exe no specs aut2exe.exe pncomd.exe no specs crack.exe

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Users\admin\Desktop\887Rat-main\AQACVJ.exe" C:\Users\admin\Desktop\887Rat-main\AQACVJ.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\desktop\887rat-main\aqacvj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
892"C:\Users\admin\Desktop\887Rat-main\crack.exe" C:\Users\admin\Desktop\887Rat-main\crack.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\887rat-main\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1760"C:\Users\admin\Desktop\887Rat-main\crack.exe" C:\Users\admin\Desktop\887Rat-main\crack.exe
887Rat-main.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\887rat-main\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1864C:\Users\admin\AppData\Local\Temp\Aut2exe.exe /in C:\Users\admin\AppData\Local\Temp/AVNLUS /out C:\Users\admin\AppData\Local\Temp/PNCOMD.exe /icon C:\Users\admin\AppData\Local\Temp\ssc.ico /comp 2 /nopack /UnicodeC:\Users\admin\AppData\Local\Temp\Aut2exe.exe
887Rat.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
Aut2Exe
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\local\temp\aut2exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2248"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\887Rat-main\887Rat-main.exe" C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\lpk.dll
2572"C:\Users\admin\AppData\Local\Temp\exe2msi.exe" C:\Users\admin\AppData\Local\Temp\exe2msi.exe—887Rat.exe
User:
admin
Company:
APREL Technologies
Integrity Level:
MEDIUM
Description:
Exe to MSI Conveter
Exit code:
0
Version:
2.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\exe2msi.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2600C:\Users\admin\AppData\Local\Temp\Aut2exe.exe /in C:\Users\admin\AppData\Local\Temp/QDZPLS /out C:\Users\admin\AppData\Local\Temp/AQACVJ.exe /icon C:\Users\admin\AppData\Local\Temp\ssc.ico /comp 2 /nopack /UnicodeC:\Users\admin\AppData\Local\Temp\Aut2exe.exe
887Rat.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
Aut2Exe
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\local\temp\aut2exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3012"C:\Users\admin\Desktop\887Rat-main\PNCOMD.exe" C:\Users\admin\Desktop\887Rat-main\PNCOMD.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\desktop\887rat-main\pncomd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3116"C:\Users\admin\Desktop\887Rat-main\887Rat.exe" C:\Users\admin\Desktop\887Rat-main\887Rat.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\887rat-main\887rat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
3132"C:\Users\admin\Desktop\887Rat-main\887Rat-main.exe" C:\Users\admin\Desktop\887Rat-main\887Rat-main.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\887rat-main\887rat-main.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
Total events
5 411
Read events
5 347
Write events
64
Delete events
0

Modification events

(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3532) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\887Rat-main.rar
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
26
Suspicious files
160
Text files
405
Unknown types
7

Dropped files

PID
Process
Filename
Type
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3532.33003\887Rat-main\887Rat-main.exe —
MD5:—
SHA256:—
3132887Rat-main.exeC:\Users\admin\Desktop\887Rat-main\887Rat.exe —
MD5:—
SHA256:—
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\aut8E32.tmp —
MD5:—
SHA256:—
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\ziwbnfi —
MD5:—
SHA256:—
3132887Rat-main.exeC:\Users\admin\Desktop\887Rat-main\crack.exeexecutable
MD5:A0A22BA1E62B67B91905665B86DF33B3
SHA256:E3CB33466BED760B23A24BD723B68CCB5DA82EE350793F4CDE7AA5AD53541B94
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\skin.888Gre.msstylesexecutable
MD5:BE3A84875ADC7D0B536E303D02EEC694
SHA256:116A4D6121EC515E2117C136B54D9C359929C720F50536E41C9DF050C9D4628F
3132887Rat-main.exeC:\Users\admin\Desktop\887Rat-main\learn all kind of hacking.urlurl
MD5:7ADE4A739CBD8F44D0EF52A2F1BC6E7B
SHA256:CC7649ED53C65E4851ACE414529564FE16801BB2BED4CB15588BFD6B4AC13616
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\skin.dllexecutable
MD5:29E1D5770184BF45139084BCED50D306
SHA256:794987C4069286F797631F936C73B925C663C42D552AECA821106DFC7C7BA307
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\autA9CD.tmpbinary
MD5:E2323BCE869FD1FF07BAD42D5B6AD64E
SHA256:886DACD85465BF0ABFEA19A0B52E6E42C6937BA60E5EC320FC4856925D975BD1
3116887Rat.exeC:\Users\admin\AppData\Local\Temp\autA5E1.tmpbinary
MD5:45560860BD0124A558B78D440C2C9DF7
SHA256:CB4906BE641770E2D24165A2CE804529C9CD96EE26029458E8A0E869CA1C5E88
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
887Rat-main.rar