e42c8b03b696cb9775ec8a60ca66c3ffacc6d0db4390059adbb4a26780e5a00e

General

Target
BitTorrent.exe
Size 3.7MB
Sample260622-p6ebfacs3p
SHA256 e42c8b03b696cb9775ec8a60ca66c3ffacc6d0db4390059adbb4a26780e5a00e
MD5 56a24dd5073ea43048b8425e98dcd302
SHA1 5ef7aa9af9d244f130b62bad2d80c1cade845212
SHA512 62e13fa474a8ca8fb06d191f3b4496f95b02f51a4f57aedcd221d4764199df34465894310573a356aaa17e2645edd9f237aaa04bd2600db0c0a801ec66834287
SSDEEP 98304:HS5pX93Tc469CLfZ23A0Ens2wCXEycSJFIgZEygHcbSiyLXVav:Hg9Q59C0w0EnXmy5IgZEym5q
TLSH
T1D70633B4D90400AFF13978B9006E436D78F8F8636337066A736C691E5671FA1E4AFB46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BitTorrent.exe
- Size 3.7MB
- SHA256 e42c8b03b696cb9775ec8a60ca66c3ffacc6d0db4390059adbb4a26780e5a00e
- MD5 56a24dd5073ea43048b8425e98dcd302
- SHA1 5ef7aa9af9d244f130b62bad2d80c1cade845212
- SHA512 62e13fa474a8ca8fb06d191f3b4496f95b02f51a4f57aedcd221d4764199df34465894310573a356aaa17e2645edd9f237aaa04bd2600db0c0a801ec66834287
- SSDEEP 98304:HS5pX93Tc469CLfZ23A0Ens2wCXEycSJFIgZEygHcbSiyLXVav:Hg9Q59C0w0EnXmy5IgZEym5q
- TLSH
  T1D70633B4D90400AFF13978B9006E436D78F8F8636337066A736C691E5671FA1E4AFB46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery upx
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/bittorrent.exe
- Size 3.5MB
- SHA256 778a64b10325db83dbe6dbdc7a45dd392ac624dd556180ea5054fbc4a9a0416a
- MD5 bbc8b5312995f09adaa689aa374445f0
- SHA1 3c7effd6644d7c7e235f7c819a8aad9a4f937353
- SHA512 2b46db316cda63d4c03ba358d8c2441e360da0198c02c7e93320a8a9a02ccfeccdfc43b084448db138259d8c02f1be6c917cef54d8acb876969e9611f6bf4bf7
- SSDEEP 98304:KRUPiMFftdWxIABFDwaol/JWmIJ2I9NGUwY71ks:SU8xIcFzol/sm62IA4t
- TLSH
  T165063323C59A057EE2021EF68486576FCCF1740A7B0C2A75F144562ECDE5FC3B926B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence ransomware spyware trojan upx
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/nsisFirewall.dll
- Size 8KB
- SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
- MD5 f5bf81a102de52a4add21b8a367e54e0
- SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
- SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
- SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
- TLSH
  T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6