General
- Target qbittorrent_5.2.3_x64_setup(1).exe
- Size 41.1MB
- Sample260916-25vm9afd55
- SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
Malware Config
Targets
-
- Target qbittorrent_5.2.3_x64_setup(1).exe
- Size 41.1MB
- SHA256 ff508e2f912d59c9eabaf03633ebacfd45c2049f38dcac027b8a7d7ad867ab2f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_ar.qm
- Size 156KB
- SHA256 e03fe68d83201543698fd7fe267dd5dfc5bfd195147e74ff2f19ac3491401263
Score3/10 -
- Target translations/qtbase_bg.qm
- Size 161KB
- SHA256 e448ac9e3f16c29eb27af3012efe21052daa78fabfb34cd6dff2f69ee3bd3cdb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_ca.qm
- Size 204KB
- SHA256 005b0aa0c9a5b930dfdd870661958a8069bbec862d75f98bce20bf7401bea13d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_cs.qm
- Size 170KB
- SHA256 03028b42df5479270371e4c3bdc7df2f56cbbe6dda956a2864ac6f6415861fe8
Score3/10 -
- Target translations/qtbase_da.qm
- Size 177KB
- SHA256 7d1e5ca3310b54d104c19bf2abd402b38e584e87039a70e153c4a9af74b25c22
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_de.qm
- Size 218KB
- SHA256 9cb5504dee6ef0d4d4be8ba2e34ba8294018a9e0ec810ceaf5e973d57a283434
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_es.qm
- Size 161KB
- SHA256 4ffda56ba3bb5414ab0482d1dde64a6f226e3488f6b7f3f11a150e01f53fa4c8
Score3/10 -
- Target translations/qtbase_fa.qm
- Size 144KB
- SHA256 f78e59b5bdd586181a999034ba418868ed17fe9c05707fb65e523f70e92253d2
Score3/10 -
- Target translations/qtbase_fi.qm
- Size 175KB
- SHA256 e47fe13713e184d07fa4495dde0c589b0e8f562e91574a3558a9363443a4fa72
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_fr.qm
- Size 155KB
- SHA256 314243a55c32679ad473fdfe48dc7d66e973ad0fc8bf2164480c58dddb50c1a7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_gd.qm
- Size 185KB
- SHA256 63b439dd44139aa3aed54c2ebe03fa9bc77f22c14ed8fba8eff2608445bb233d
Score3/10 -
- Target translations/qtbase_he.qm
- Size 135KB
- SHA256 e1ebca16afe8994356f81ca007fbdb9ddf865842010fe908923d873b687cad3f
Score3/10 -
- Target translations/qtbase_hr.qm
- Size 146KB
- SHA256 bb9eec9a9a652c1340dc75eb2e749be50df00f885b3d6900dfc76799c45b244d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_hu.qm
- Size 201KB
- SHA256 98463295539d769c8645a0b7fb95ad38454cfd0b14f36af485513f036ddbbbc6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target translations/qtbase_it.qm
- Size 157KB
- SHA256 7808ed542a7833c4bd94ec8bdfbbca00bb4f2fe15979b9121ce3249323687300
Score3/10