Like many modern Trojans, it may attempt to establish a foothold on the host system to remain active after reboots. Risk Summary

Detailed sandboxing on ANY.RUN indicates the following behaviors:

The tool is built using Python and packaged as a Windows executable via PyInstaller . This is a common technique used by malware authors to hide malicious scripts within a legitimate-looking container. Indicators of Compromise (IOCs): MD5: 02EADD468D5B5A606F3A73770AE73A41

Upon execution, the PyInstaller-packed script likely targets sensitive local data, including: Saved browser credentials and cookies. System metadata for remote tracking. Potential keylogging or clipboard hijacking.

Mail Access Checker by G-KLIT.exe (contained within the .rar archive). Verdict: Malicious Activity Detected .