Overview
overview
7Static
static
3qbittorren...up.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...lW.dll
windows11-21h2-x64
3qbittorrent.exe
windows11-21h2-x64
1Analysis
- user interaction
yes - max time kernel
139s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/08/2026, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
qbittorrent_5.2.3_x64_setup.exe
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisFirewallW.dll
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
qbittorrent.exe
Resource
win11-20260513-en
General
- Target qbittorrent.exe
- Size 41.3MB
- Sample260806-e6ebbsx1d1
- SHA256 f69360ae8545a64f4fc84fb6bacef03d77a6aa0793a4c14d4a28651ca26a27d1
- MD5 0ac96cecadaa65abdcd587c9b4554e82
- SHA1 70db70b82eb49a2bf1bcf6079c56c5f929c23d00
- SHA512 a4ec9f241c815de4a50b6c9fd50408c4d593ea9580f7c220fe3d7d7440fdbbdb80bf3246a049e5b38a2cb85fb8d01357bca3db752fd9eb996a6d12e903ea0c7d
- SSDEEP 393216:d1cQ1hWhcknyRLhIMYIB5mH4yU2lT4IKEXERyJdgsoGQn/tnTfKFdu9CwJsv6tai:c4yUK0BEXEgd1XQ/tT44mO
- TLSH T13897AE56A7F80195E0FBC27886679113E7B1B846133497EF02A496B91F73AF05E3E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1680 qbittorrent.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1680 qbittorrent.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe 1680 qbittorrent.exe