Overview

overview

10

Static

static

1

qbittorren...up.exe

windows7-x64

7

qbittorren...up.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qbittorrent_4.5.2_x64_setup.exe

  • Size

    31.3MB

  • Sample

    230406-p86tgadb57

  • MD5

    c9cd92842c3fe0cbb53e320d46eb71cf

  • SHA1

    1bbbf8fc8b6ac9dc40ffb01b0d521c1b81174216

  • SHA256

    f2ec7fa4c5ae273d6d7181c0c9df225eb8ce8e0e85577b236c7b335c093f2e71

  • SHA512

    fb7f4c71c50b7ff77c8ddc41c6c4d944d8138b0d9b7e948ef16815e4f76a26b9e8f28610866fc9455ffcf04d2e38ceddf15020526730a8154694f2ac501b7138

  • SSDEEP

    786432:rFUPR+I5pNSnPbDAMzkWeumVDg9ptSF+40S5cCPJ2SAqKEUHwg:rFS+2pNcbUMoTumxXBqCPFAq3GF

Score
10/10
bazarloaderdiscoverydropperloader

Malware Config

Targets

    • Target

      qbittorrent_4.5.2_x64_setup.exe

    • Size

      31.3MB

    • MD5

      c9cd92842c3fe0cbb53e320d46eb71cf

    • SHA1

      1bbbf8fc8b6ac9dc40ffb01b0d521c1b81174216

    • SHA256

      f2ec7fa4c5ae273d6d7181c0c9df225eb8ce8e0e85577b236c7b335c093f2e71

    • SHA512

      fb7f4c71c50b7ff77c8ddc41c6c4d944d8138b0d9b7e948ef16815e4f76a26b9e8f28610866fc9455ffcf04d2e38ceddf15020526730a8154694f2ac501b7138

    • SSDEEP

      786432:rFUPR+I5pNSnPbDAMzkWeumVDg9ptSF+40S5cCPJ2SAqKEUHwg:rFS+2pNcbUMoTumxXBqCPFAq3GF

    Score
    10/10
    bazarloaderdiscoverydropperloader

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Bazar/Team9 Loader payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks