File name:

Client.Windows.rar

Full analysis: https://app.any.run/tasks/b5cf2e9b-cc65-4c0a-b9e2-a76e070cbc95
Verdict: Malicious activity
Analysis date: April 29, 2025, 13:22:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

EA1A8EE90918585933AEA50C7A9CB1A2

SHA1:

1AE35ED455CE52E0315324A311C6EA4B7AF5D4F6

SHA256:

EED7FFD6ECBE351B32096608EA12BB8A40EEE592EC225742B9E6FDC80C5CF8A0

SSDEEP:

98304:CbQhtW/RqYjX0dUc5tnLi0DtGNaxEr1tsbV1foOr6Pi7hNrxnNrgUfhRUfM8FSve:vbc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2236)

  • SUSPICIOUS

    • Connects to unusual port

      • NetRAT.Client.Windows.exe (PID: 1784)
      • NetRAT.Client.Windows.exe (PID: 2916)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2236)

    • Reads the computer name

      • NetRAT.Client.Windows.exe (PID: 1784)
      • NetRAT.Client.Windows.exe (PID: 2916)

    • Manual execution by a user

      • NetRAT.Client.Windows.exe (PID: 1784)
      • NetRAT.Client.Windows.exe (PID: 2916)

    • Checks supported languages

      • NetRAT.Client.Windows.exe (PID: 1784)
      • NetRAT.Client.Windows.exe (PID: 2916)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2236)

    • Reads the machine GUID from the registry

      • NetRAT.Client.Windows.exe (PID: 1784)
      • NetRAT.Client.Windows.exe (PID: 2916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 545878
UncompressedSize: 1263104
OperatingSystem: Win32
ArchivedFileName: NetRAT.Client.Windows.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe netrat.client.windows.exe svchost.exe netrat.client.windows.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1784"C:\Users\admin\Desktop\NetRAT.Client.Windows.exe" C:\Users\admin\Desktop\NetRAT.Client.Windows.exe
explorer.exe
User:
admin
Company:
UnknownComp
Integrity Level:
MEDIUM
Description:
NetRAT Client
Exit code:
3221225786
Version:
2025.4.29.10024
Modules
Images
c:\users\admin\desktop\netrat.client.windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2236"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Client.Windows.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2916"C:\Users\admin\Desktop\NetRAT.Client.Windows.exe" C:\Users\admin\Desktop\NetRAT.Client.Windows.exe
explorer.exe
User:
admin
Company:
UnknownComp
Integrity Level:
MEDIUM
Description:
NetRAT Client
Version:
2025.4.29.10024
Modules
Images
c:\users\admin\desktop\netrat.client.windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
Total events
2 130
Read events
2 102
Write events
28
Delete events
0

Modification events

(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2236) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Client.Windows.rar
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2236) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2236WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2236.26769\libcrypto-3.dllexecutable
MD5:B80B7DE70E5250315EC6947472754EAF
SHA256:503AB52E2E455BB31E6B5D9983BDCEE758DDF3B5F393962F78ACD8420EFED69B
2236WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2236.26769\NetRAT.Client.Windows.exeexecutable
MD5:105F7121BCA5CE0AB4A366912CF74236
SHA256:72FFC4123DFEAC4C319870B39907932449C25484F01FAC5BF38E83EE72D00DBF
2236WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2236.26769\libssl-3.dllexecutable
MD5:44219E1430D570B42219623DAFE6F721
SHA256:2459B52803E8D6A2A6D93A775A8618966C63265BF88AD8C0F761063783D96551
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
2
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1784
NetRAT.Client.Windows.exe
147.185.221.27:20358
european-liability.gl.at.ply.gg
PLAYIT-GG
US
malicious
2916
NetRAT.Client.Windows.exe
147.185.221.27:20358
european-liability.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
european-liability.gl.at.ply.gg
  • 147.185.221.27
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
1080
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Client.Windows.rar