File name:

Re-Loader Activator 1.6 Final.zip

Full analysis: https://app.any.run/tasks/d4dceb09-5773-4f4c-831a-8085b8cd41b4
Verdict: Malicious activity
Analysis date: June 24, 2024, 20:29:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

213C227DF1EBB8B614A3CFDD97ACF482

SHA1:

7FE698AEDB011F921FA0213CFB5C3967BEA59A20

SHA256:

F4DB66DEB94BC51EB6181A3F8BDEBC1B507158127270AE223D416C2A2650D74E

SSDEEP:

49152:dmiq2ZODhcb3IGYjpjXrFb9+k7MWIHYM94M4UUcSlIPMyCawxfjiwgW68fmKDIT7:siNOF8IVZZbQCMWfMS5ClJCamjiwo8fq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3332)
      • Re-LoaderByR@1n.exe (PID: 3100)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 3332)
      • Re-LoaderByR@1n.exe (PID: 3100)

    • Reads the Internet Settings

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Searches for installed software

      • dllhost.exe (PID: 1680)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1808)

    • Process drops legitimate windows executable

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Executable content was dropped or overwritten

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Starts a Microsoft application from unusual location

      • brset.exe (PID: 3408)
      • bootsect.exe (PID: 2064)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3332)

    • Reads the computer name

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)

    • Reads the machine GUID from the registry

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)

    • Reads Microsoft Office registry keys

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Reads Environment values

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Checks supported languages

      • Re-LoaderByR@1n.exe (PID: 3100)
      • Re-LoaderByR@1n.exe (PID: 596)
      • brset.exe (PID: 3408)
      • bootsect.exe (PID: 2064)

    • Reads product name

      • Re-LoaderByR@1n.exe (PID: 3100)

    • Create files in a temporary directory

      • Re-LoaderByR@1n.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2015:12:18 20:52:00
ZipCRC: 0x4467c54e
ZipCompressedSize: 5691
ZipUncompressedSize: 16287
ZipFileName: Re-Loader Activator 1.6 Final/Leggimi.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe re-loaderbyr@1n.exe no specs re-loaderbyr@1n.exe re-loaderbyr@1n.exe no specs re-loaderbyr@1n.exe SPPSurrogate no specs vssvc.exe no specs brset.exe no specs bootsect.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
596"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.32094\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1680C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1808C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2064"C:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\bootsect.exe" /nt52 SYS /forceC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\bootsect.exe—Re-LoaderByR@1n.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Sector Manipulation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\re-loader\oem\bootsect.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2864"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.32094\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
3100"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
Activator
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.31244\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3272"C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Activator
Exit code:
3221226540
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3332.31244\re-loader activator 1.6 final\re-loaderbyr@1n.exe
c:\windows\system32\ntdll.dll
3332"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Re-Loader Activator 1.6 Final.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3408"C:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\brset.exe" /nt60 SYS /forceC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\brset.exe—Re-LoaderByR@1n.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Sector Manipulation Tool
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\users\admin\appdata\local\temp\re-loader\oem\brset.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 988
Read events
5 826
Write events
162
Delete events
0

Modification events

(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3332) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Re-Loader Activator 1.6 Final.zip
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3332) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
5
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1680dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3408brset.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
2064bootsect.exe\Device\HarddiskVolume1 —
MD5:—
SHA256:—
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3332.31244\Re-Loader Activator 1.6 Final\Leggimi.txttext
MD5:CCD71B530AAF28D23EB5ABA10EEABCBF
SHA256:D3192C50503738528934D4B60033C4E8A18E22D193D181EAFF4B77929FA5749D
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3332.32094\Re-Loader Activator 1.6 Final\Leggimi.txttext
MD5:CCD71B530AAF28D23EB5ABA10EEABCBF
SHA256:D3192C50503738528934D4B60033C4E8A18E22D193D181EAFF4B77929FA5749D
3100Re-LoaderByR@1n.exeC:\Users\admin\AppData\Local\Temp\Re-Loader\DEFAULT.XRM-MSxml
MD5:18B1E45BF56F40C3C4BBE65831178216
SHA256:D072A059D3ED3E75C98B85B41E4319E8D5CFAE0E0C239B62436A3AD34003AB4A
3100Re-LoaderByR@1n.exe\\?\Volume{e1a82db3-a9f0-11e7-b142-806e6f6e6963}\NYW4Ubinary
MD5:4012324BF3C047D619E651198CC04EBF
SHA256:9B901E4157A2E74BEA6CF4BDAE4CA0D028194DF88D29969B99ADA177D9CF1F1B
3100Re-LoaderByR@1n.exeC:\Users\admin\AppData\Local\Temp\Re-Loader\OEM\CustomSLIC\NYW4Ubinary
MD5:4908E7A4441A380EF07E30D5F0AC48D1
SHA256:D8A3ECD656EF4901CBEB822CDFB71A46D707331C60166DBF53DA2FFB2FBA1326
3332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3332.32319\Re-Loader Activator 1.6 Final\Re-LoaderByR@1n.exeexecutable
MD5:292FF22AEC228B1AC75730C25080CEAD
SHA256:5F5A97FD1EA82BCB87215A804574A51ECCD399B0290FBC6CFE6DDD708DE92DAA
1680dllhost.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4D83F4DF44F4FE3BA34775A5DB1EF37D
SHA256:207E2ABA433373C4E90AEEAE2DB2A82336C88BE3E0CF0DB12F2CABF9D90B0A1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
43.152.26.221:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
—
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
43.152.26.221:80
ctldl.windowsupdate.com
ACE
DE
unknown
1372
svchost.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
1372
svchost.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
ctldl.windowsupdate.com
  • 43.152.26.221
  • 43.152.26.197
  • 43.152.26.58
  • 43.152.26.151
  • 43.152.26.154
  • 43.152.26.104
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.24
  • 2.16.164.40
  • 2.16.164.32
  • 2.16.164.120
  • 2.16.164.51
  • 2.16.164.97
  • 2.16.164.106
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.218.209.163
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Re-Loader Activator 1.6 Final.zip