hxxp://magnet?xt=urn[:]btih[:]A89768BA4D6550B882C7E926D5A84472CD220B3E&dn=Schedule%20I%20(v0[.]4[.]6f13)&tr=udp%3A%2F%2Ftracker[.]opentrackr[.]org%3A1337&tr=udp%3A%2F%2Fopen[.]stealth[.]si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker[.]torrent[.]eu[.]org%3A451%2Fannounce&tr=udp%3A%2F%2Ftracker[.]bittor[.]pw%3A1337%2Fannounce&tr=udp%3A%2F%2Fpublic[.]popcorn-tracker[.]org%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker[.]dler[.]org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexodus[.]desync[.]com%3A6969&tr=udp%3A%2F%2Fopen[.]demonii[.]com%3A1337%2Fannounce&tr=udp%3A%2F%2Fglotorrents[.]pw%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker[.]coppersurfer[.]tk%3A6969&tr=udp%3A%2F%2Ftorrent[.]gresille[.]org%3A80%2Fannounce&tr=udp%3A%2F%2Fp4p[.]arenabg[.]com%3A1337&tr=udp%3A%2F%2Ftracker[.]internetwarriors[.]net%3A1337

General

Target
http://magnet?xt=urn:btih:A89768BA4D6550B882C7E926D5A84472CD220B3E&dn=Schedule%20I%20(v0.4.6f13)&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.torrent.eu.org%3A451%2Fannounce&tr=udp%3A%2F%2Ftracker.bittor.pw%3A1337%2Fannounce&tr=udp%3A%2F%2Fpublic.popcorn-tracker.org%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.dler.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce&tr=udp%3A%2F%2Fglotorrents.pw%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337&tr=udp%3A%2F%2Ftracker.internetwarriors.net%3A1337
Sample261030-ef91baav3r

Score

9^/10

Malware Config

Targets

- Target
  http://magnet?xt=urn:btih:A89768BA4D6550B882C7E926D5A84472CD220B3E&dn=Schedule%20I%20(v0.4.6f13)&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.torrent.eu.org%3A451%2Fannounce&tr=udp%3A%2F%2Ftracker.bittor.pw%3A1337%2Fannounce&tr=udp%3A%2F%2Fpublic.popcorn-tracker.org%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.dler.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce&tr=udp%3A%2F%2Fglotorrents.pw%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Ftorrent.gresille.org%3A80%2Fannounce&tr=udp%3A%2F%2Fp4p.arenabg.com%3A1337&tr=udp%3A%2F%2Ftracker.internetwarriors.net%3A1337
Score

9^/10

defense_evasion discovery persistence spyware trojan
- Contacts a large (2565) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1