Overview

overview

10

Static

static

1

utorrent_i...er.exe

windows7-x64

4

utorrent_i...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    utorrent_installer.exe

  • Size

    1.7MB

  • Sample

    230815-x9vftsdd43

  • MD5

    8399e2328e74253f7d5ae6293840d954

  • SHA1

    e2054432a188315d45f41c5e4adf1871b8d19458

  • SHA256

    b628a28046502aeb3befc908c4383341d2a5164baf8a86dfd7e92a3ec23ef11d

  • SHA512

    493b254989dd3e22456d3f63ae438bed6a1304afaa79ca0d9bf08735d58c388f12b3a4ee722d3c37e83eed1657d8ede0316a677cadba6c71bdd0a661d830a212

  • SSDEEP

    24576:B7FUDowAyrTVE3U5FFd+797LgRs7LT2ub2K0id2FNasFwbjRf:BBuZrEUo97LyOfrKzAw6d

Score
10/10
bootkitevasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      utorrent_installer.exe

    • Size

      1.7MB

    • MD5

      8399e2328e74253f7d5ae6293840d954

    • SHA1

      e2054432a188315d45f41c5e4adf1871b8d19458

    • SHA256

      b628a28046502aeb3befc908c4383341d2a5164baf8a86dfd7e92a3ec23ef11d

    • SHA512

      493b254989dd3e22456d3f63ae438bed6a1304afaa79ca0d9bf08735d58c388f12b3a4ee722d3c37e83eed1657d8ede0316a677cadba6c71bdd0a661d830a212

    • SSDEEP

      24576:B7FUDowAyrTVE3U5FFd+797LgRs7LT2ub2K0id2FNasFwbjRf:BBuZrEUo97LyOfrKzAw6d

    Score
    10/10
    bootkitevasionpersistencespywarestealertrojanupx

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Sets service image path in registry

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks