Fake WinRAR downloads hide malware behind a real installer

According to Malwarebytes, a fake WinRAR installer linked from various Chinese websites was analysed by Pieter Arntz on January 8, 2026, revealing a multi-layered dropper that hides behind a real installer. The original file named winrar-x64-713scp[.]zip unpacks to winrar-x64-713scp1.exe, a UPX-packed payload that uses a forced unpack step, then reveals another layer with a suspicious RunProgram sequence to execute embedded components immediately after extraction.

One of the embedded files, 1winrar-x64-713scp1.exe, is the actual WinRAR installer, while a second dropper, setup.hta, unpacks at runtime into memory and points to nimasila360.exe, a file associated with the Winzipper family of malware. The campaign is noted to target Windows users via links or attachments, with indicators of compromise including domains such as winrar-tw[.]com, winrar-x64[.]com and winrar-zip[.]com, and filenames like winrar-x64-713scp[.]zip, youhua163安装.exe and setup.hta.

Malwarebytes’ analysis explains that these payloads can download further malware, establish persistence, exfiltrate data or open backdoors, depending on system conditions.