General
- Target qbittorrent_5.2.2_x64_setup.exe
- Size 41.1MB
- Sample260703-ztcl7af151
- SHA256 219de2b0133bf8408f40450a389c227f8d1c2bb520d6d10d1833bc528ca2cd10
Malware Config
Targets
-
- Target qbittorrent_5.2.2_x64_setup.exe
- Size 41.1MB
- SHA256 219de2b0133bf8408f40450a389c227f8d1c2bb520d6d10d1833bc528ca2cd10
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
Score3/10 -
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsisFirewallW.dll
- Size 8KB
- SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target qbittorrent.exe
- Size 41.3MB
- SHA256 1dc64e7e85d902ead61181ee820b22006a4cc78f8508eeea7e6b2f80ad7210be
Score1/10