Overview

overview

10

Static

static

10

qbittorren...up.exe

windows7-x64

7

qbittorren...up.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

6

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...lW.dll

windows7-x64

3

$PLUGINSDI...lW.dll

windows10-2004-x64

3

qbittorrent.exe

windows7-x64

1

qbittorrent.exe

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...lW.dll

windows7-x64

3

$PLUGINSDI...lW.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qbittorrent_4.5.4_x64_setup.exe

  • Size

    31.3MB

  • MD5

    6e35e4512488a44ebf34bff82dc4724f

  • SHA1

    38903134b1a0a774cdcf728d3484493e7d83592a

  • SHA256

    3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615

  • SHA512

    a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e

  • SSDEEP

    786432:rVrG7dnL27saKvlVIbS7ykgixD9ZLstXfL:rVrsdn0sa8IbShgiVXLstXT

Score
10/10
bazarloader

Malware Config

Signatures

  • Bazar/Team9 Loader payload 1 IoCs
  • Bazarloader family
    bazarloader
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

Files

  • qbittorrent_4.5.4_x64_setup.exe
    .exe windows:4 windows x86 arch:x86

    61259b55b8912888e90f516ca08dc514


    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:5 windows x86 arch:x86

    0cd94af3a016a5de4ab9a5a9a02d4173


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    3e8d18bb71c7ebbda2ddc2a4bb03547b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisFirewallW.dll
    .dll windows:4 windows x86 arch:x86

    18ecfc7436b69f8c13ec22664f9f1857


    Headers

    Imports

    Exports

    Sections

  • qbittorrent.exe
    .exe windows:6 windows x64 arch:x64

    a40bfbcdcf64f0eb989ef6c078effc57


    Headers

    Imports

    Sections

  • qbittorrent.pdb
  • qt.conf
  • translations/qt_gl.qm
  • translations/qt_lt.qm
  • translations/qt_pt_PT.qm
  • translations/qt_sl.qm
  • translations/qt_sv.qm
  • translations/qtbase_ar.qm
  • translations/qtbase_bg.qm
  • translations/qtbase_ca.qm
  • translations/qtbase_cs.qm
  • translations/qtbase_da.qm
  • translations/qtbase_de.qm
  • translations/qtbase_es.qm
  • translations/qtbase_fa.qm
  • translations/qtbase_fi.qm
  • translations/qtbase_fr.qm
  • translations/qtbase_gd.qm
  • translations/qtbase_he.qm
  • translations/qtbase_hr.qm
  • translations/qtbase_hu.qm
  • translations/qtbase_it.qm
  • translations/qtbase_ja.qm
  • translations/qtbase_ko.qm
  • translations/qtbase_lv.qm
  • translations/qtbase_nl.qm
  • translations/qtbase_nn.qm
  • translations/qtbase_pl.qm
  • translations/qtbase_pt_BR.qm
  • translations/qtbase_ru.qm
  • translations/qtbase_sk.qm
  • translations/qtbase_tr.qm
  • translations/qtbase_uk.qm
  • translations/qtbase_zh_CN.qm
  • translations/qtbase_zh_TW.qm
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    61259b55b8912888e90f516ca08dc514


    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:5 windows x86 arch:x86

    0cd94af3a016a5de4ab9a5a9a02d4173


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    3e8d18bb71c7ebbda2ddc2a4bb03547b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsisFirewallW.dll
    .dll windows:4 windows x86 arch:x86

    18ecfc7436b69f8c13ec22664f9f1857


    Headers

    Imports

    Exports

    Sections