e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7

General

Target
utorrent_installer.exe
Size 3.7MB
Sample260821-xeszhsch93
SHA256 e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7
MD5 7b1bcf79461ed67aa315a4e156dc83f7
SHA1 d15d84e371af61b2497d0f825167d8d19caa9ea6
SHA512 3857a4642a0e5911d46a96ee66309fc414997b347500dd90e8a88f8c578de615849d24ce02080cb30633ec822e2ec2e0503ea86819ba05d3a9ef795cb43c21f4
SSDEEP 98304:yg3iGC5mAyFoVCVMZUkPk0XdC/eBWLhR4qdGcQi:ywi95jooCM+gC2B6hR4/O
TLSH
T145063361E664FC6AE57885F5008B53CE9C63BC07F26C2BB387A1363B7B312415A94F49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  utorrent_installer.exe
- Size 3.7MB
- SHA256 e2837e13d80e4602b0c2d711c6d6c17217f4a80c8ff0b33dd90df219f025f3b7
- MD5 7b1bcf79461ed67aa315a4e156dc83f7
- SHA1 d15d84e371af61b2497d0f825167d8d19caa9ea6
- SHA512 3857a4642a0e5911d46a96ee66309fc414997b347500dd90e8a88f8c578de615849d24ce02080cb30633ec822e2ec2e0503ea86819ba05d3a9ef795cb43c21f4
- SSDEEP 98304:yg3iGC5mAyFoVCVMZUkPk0XdC/eBWLhR4qdGcQi:ywi95jooCM+gC2B6hR4/O
- TLSH
  T145063361E664FC6AE57885F5008B53CE9C63BC07F26C2BB387A1363B7B312415A94F49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsisFirewall.dll
- Size 8KB
- SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
- MD5 f5bf81a102de52a4add21b8a367e54e0
- SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
- SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
- SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
- TLSH
  T16DF1F936B7E18171C26F02B09F4F569DE1F8E66067E0013377628B5D2EB029DE836526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/utorrent.exe
- Size 3.5MB
- SHA256 285127f8530fcdb0166cf37c97e60a13ecff7d57d3f0066e7cec0e89188e9ae2
- MD5 657775f666c15e8ac34687e994dba93c
- SHA1 7462a199219a13700b48b3bfb094dcb6273d29cf
- SHA512 a8ac6aa8ec3453c7d098b42f4b163ae8fe04c335213a9dd7ed39be76758064064b71d4d0dc1573c575f2a3d7df6a62cbf22323220dddfbd2d74220580375065f
- SSDEEP 98304:O12+yYUKanBkVVZHvXzSoInsqsCBVCpTLNMYuA4FGPsI:O1BU5nC1bS1dspTBuNy
- TLSH
  T179063392DE312E84E0FE52F514694AA84121EE4A7D5C1F334231763D5F360C2EABADE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence spyware trojan upx
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral6