AVL Code
All cases
#021 · Sample Analysis

Analysis of a Malicious Loader Disguised as a WinRAR Installer

To thoroughly analyze a malicious-loader-to-remote-control-backdoor chain disguised as a WinRAR installer, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.

Built with AVL Code + the Landi model

Malicious LoaderWinRAR DisguisePowerShell BackdoorScheduled-Task PersistenceHosts Hijacking

Overview

Facing a PE32 malicious loader packed with Setup Factory and disguised as the official WinRAR installer, analysts drove AVL Code with one natural-language instruction to reverse-engineer it in depth: untangling the dual-layer scheduled-task persistence chain built from three dropped BAT scripts — a one-shot launcher (once.bat), a 5-minute recurring trigger (connectionupdate2.bat), and the core payload (connectionupdate.bat) that adds a Defender exclusion, hijacks the hosts file, and downloads a backdoor — reconstructing the full attack chain from four hijacked-domain hosts entries through to a memory-only PowerShell RAT backdoor (a.ps1) that polls its C2 every 5 seconds, binds to a device UID, and executes arbitrary commands. In about 3 minutes it produced a report with a complete IOC list, an attack-chain timeline, and a removal plan, classified as Critical.

Key results

  • Fully reverse-engineered the PE32 malicious loader disguised as a WinRAR installer, identifying its Setup Factory packing and three-stage BAT-script drop chain
  • Reconstructed the dual-layer scheduled-task persistence mechanism — once.bat creates a startup task then self-deletes; connectionupdate2.bat creates a 5-minute recurring task to keep the core payload running
  • Identified hosts-file hijacking (4 hijacked domain entries) and a memory-resident PowerShell RAT backdoor, a.ps1 (polls its C2 every 5 seconds, binds to a device UID, executes arbitrary commands)
  • Extracted a complete IOC list (5 file hashes, 2 C2 addresses, 4 hijacked domains, 2 scheduled-task names, 2 registry paths), producing an attack-chain timeline and removal plan in about 3 minutes, classified as Critical

Technical highlights

Malicious loader analysisSetup Factory packing identificationMulti-stage BAT-script drop-chain analysisDual-layer scheduled-task persistence detectionHosts-file hijacking detectionFileless PowerShell backdoor analysis

Practical value

Helps security operations teams rapidly identify and respond to remote-control trojan threats, provides end-to-end guidance from detection to removal, strengthens detection and handling of disguised loaders and fileless attacks, and effectively protects Windows system security.

Artifacts

View session Download session import into your workspace for full detail View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model