MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned 7z archive with process-injection + direct-IP C2 behaviour and 4 tier-2 detections, but 15 tier-1 engines silent and no external corroboration.

vmprotect
Trust score52Caution
MT AI confidence · 68%
ARCLoader.7z
11.0 MB
3822081b8f1990a93c…6b22d8e7c6
Antivirus engines
8 of 75 flagged
Code signing
Unsigned
Age
First seen 5 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

68%Confidence
High
Reasoning

This unsigned 7z archive triggered two high-confidence heuristic rules: process injection (rundll32 loading DLLs from temp) and direct-IP C2 (contacted 162.159.36.2 with zero DNS queries). Four tier-2 engines detected it with generic labels. The file is packed with VMProtect and exhibits evasion tags (debug-environment detection, long-sleeps). However, tier-1 engines (Kaspersky, Microsoft, BitDefender, Avast, Avira, ESET, Fortinet, GData, Emsisoft, DrWeb, F-Secure) all reported clean, and no external researchers have published YARA rules or MalwareBazaar signatures. The absence of tier-1 consensus and external corroboration, combined with the strong behavioural signals, places this in suspicious territory rather than definitive malicious.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 4/62 tier-2 malicious (Google, Malwarebytes, Sangfor, Varist) with generic labels; tier1Malicious=0; no tier-1 consensus

  2. triggeredHeuristics: MalwareTips.Synth.ProcessInjection (high) + MalwareTips.Synth.DirectIpC2 (medium) — T1055 + direct-IP C2 without DNS

  3. behaviour: rundll32 chains injecting ARChandler.dll, ARCinjector.dll, PatchLB3.dll; contacted 162.159.36.2 (direct IP, no domains)

  4. file tags: detect-debug-environment, long-sleeps, checks-user-input, contains-pe; popularThreatName=vmprotect (packing)

  5. prevalence: medium (4 submitters, 5 days); unsigned, no signer history

Points in its favour
  • 15 tier-1 antivirus engines (Kaspersky, Microsoft, BitDefender, ESET, Fortinet, Avast, Avira, Emsisoft, DrWeb, F-Secure, GData, Avira, AVG, Avast, Emsisoft) reported clean
  • No malicious dropped children identified (7 inspected, all unknown verdict)
  • No malicious contacted hosts in our URL cache
  • No external-intelligence hits (CIRCL, YARAify, MalwareBazaar negative)
Points against
  • Process injection (T1055) via rundll32 loading DLLs from temp directory
  • Direct-IP C2 contact (162.159.36.2) without DNS queries — bypasses reputation systems
  • VMProtect packing and anti-analysis tags (debug-environment detection, long-sleeps)
  • Unsigned archive with no publisher identity
  • Multi-stage loader architecture (7 dropped children, 4 rundll32 chains)
What to do

Treat this file as suspicious and avoid execution in production environments. The mixed detection profile (tier-2 flagging vs. tier-1 silence) and absence of external corroboration warrant caution but do not yet constitute definitive malware confirmation. Monitor for vendor updates and consider submitting to your security team for manual analysis if the source is trusted.

Threat family attribution

vmprotect corroborated by 2 sources

  • VT (75 engines)
    vmprotect
  • MT AI Engine
    vmprotect
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
9

Adversary techniques mapped to the MITRE ATT&CK framework.

T1033T1055T1056T1071T1082T1129T1497T1562.001T1574
Spawned processes
9
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\ARChandler.dll",#1
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\ARCinjector.dll",#1
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\bin\PatchLB3.dll",#1
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\ARCLoader.exe"
$(unnamed)
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\bin\SLib3NET7.dll",#1
$(unnamed)
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 740
$(unnamed)
C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\ARCLoader.7z"
$(unnamed)
C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ecka1dai.4tw" "C:\Users\user\Desktop\ARCLoader.7z"
+1 more processes captured.
Network activity
1
IP addresses1
  • 162.159.36.2
Filesystem & mutexes
15
Files written15
  • C:\ProgramData\Microsoft\Windows\WER\Temp
  • C:\ProgramData\Microsoft\Windows\WER\Temp\dff2c86a-f8d8-491b-ac92-ea03430f7f93
  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue
  • C:\ProgramData\Microsoft\Windows\WER\Temp\d9765631-780f-4308-9def-96c684d18429
  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive
+10 more
Dropped payload

Files this sample writes at runtime

This file drops 7 children at runtime. None are currently flagged malicious in our cache.

7 unseen
  • d8cd5b515c8e8edc88e5…21b177Never scanned
    never seen before
  • 6192d654fd0a13afd803…0229f1Never scanned
    never seen before
  • b68409c9d8b81321c3b7…c11ac9Never scanned
    never seen before
  • 528837e2522323c54013…641a7aNever scanned
    never seen before
  • bc93ac9a0fe6b7d60c68…0d3127Never scanned
    never seen before
  • 469c9a32ffc0b7224086…2730ebNever scanned
    never seen before
  • 81d125b27784f59226d0…8c0c96Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\ARChandler.dll",#1
  • DirectIpC2
    T1071
    medium

    Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    162.159.36.2
Antivirus engine breakdown

8 detections across 75 engines

8 malicious0 suspicious67 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
4flag
Mainstream engines with mixed FP rates
Low-trust20 engines
4flag
Heuristic / generic-AI engines (high FP rate)
alibabacloud
malicious
VirTool:Win/Packed.VMProtect.AT
Antiy-AVL
malicious
Trojan[Packed]/Win64.VMProtect
Bkav
malicious
W32.Malware.6463A007
Google
malicious
Detected
Malwarebytes
malicious
Malware.Heuristic.2108
MaxSecure
malicious
Trojan.Malware.300983.susgen
Sangfor
malicious
Trojan.Win32.Agent.V6si
Varist
malicious
W64/ABApplication.ABPW-7324
Hash 3822081b8f19… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
4
Moderate upload volume.
Total submissions
4
Includes repeat uploads by the same source.
First seen by VT
5d ago
Jun 10, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/10/2026, 5:13:23 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
6/14/2026, 10:27:21 PM
Scanned here
6/15/2026, 3:27:16 PM
File name
ARCLoader.7z
Size
11.00 MB
MIME type
(unknown)
Detected type
7ZIP
SHA-256
3822081b8f1990a93cd887e590611131208613df661c436edc09926b22d8e7c6
MD5
5752b2223b3c49deea0d6df6233719ce
SHA-1
6ab786da601d5d417d07c4f12d052c7dab415efe
First seen (VT)
6/10/2026, 5:13:23 AM
Last analysis (VT)
6/14/2026, 10:27:21 PM
First scan (MalwareTips)
6/15/2026, 3:27:16 PM
Last scan (MalwareTips)
6/15/2026, 3:27:16 PM
Behavior tags
detect-debug-environment7ziplong-sleepschecks-user-inputcontains-pe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.