File name:

utorrent_installer.exe

Full analysis: https://app.any.run/tasks/37f84cc2-a2eb-4e1f-bdba-f93ee7bfbe68
Verdict: Malicious activity
Analysis date: June 10, 2024, 21:43:00
OS: Ubuntu 22.04.2
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6899C281EE35C7222658AFB974AE090B

SHA1:

9F3E90859A59F41B7AE36E4F1736994DA0005232

SHA256:

D0DD0FD94BF0CF78BD9613749DFEE32EAC544C84078C4569D3608C07306D9DCC

SSDEEP:

49152:Y7HecD4dnbibBlRzsjnj27kHAggw099DbfdGwCnOarpkiauE6tX5mH7a96USKiGN:k+cD4dngzsjnZAA099DLdGwCOgoux15j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks DMI information (probably VM detection)

      • systemd-hostnamed (PID: 12485)

    • Executes commands using command-line interpreter

      • file-roller (PID: 12521)

    • Executes the "rm" command to delete files or directories

      • file-roller (PID: 12494)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 73216
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.6.0.0
ProductVersionNumber: 3.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: uТorrеnt® Classic
FileVersion: 3.6
LegalCopyright: ©2022 RainBerry Inc. All Rights Reserved
OriginalFileName:
ProductName: uТorrеnt® Classic
ProductVersion: 3.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
237
Monitored processes
22
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
sh no specs file no specs sh no specs sudo no specs nautilus no specs locale-check no specs systemd-hostnamed no specs nautilus no specs file-roller no specs 7z no specs 7z no specs file-roller no specs gnome-disks no specs gvfsd-network no specs gvfsd-smb-browse gvfsd-dnssd no specs 7z no specs mv no specs rm no specs tracker-extract-3 no specs nautilus no specs gnome-disks no specs

Process information

PID
CMD
Path
Indicators
Parent process
12459sh -c "file --mime-type /home/user/Desktop/utorrent_installer\.exe"/bin/sh—any-guest-agent
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
12460file --mime-type /home/user/Desktop/utorrent_installer.exe/usr/bin/file—sh
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
12461/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus /home/user/Desktop/utorrent_installer\.exe "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
12462sudo -iu user nautilus /home/user/Desktop/utorrent_installer.exe/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
12463nautilus /home/user/Desktop/utorrent_installer.exe/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
12464/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
12485/lib/systemd/systemd-hostnamed/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
12493nautilus /home/user/Desktop/utorrent_installer.exe/usr/bin/nautilus—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
12463
12494file-roller /home/user/Desktop/utorrent_installer.exe/usr/bin/file-roller—nautilus
User:
user
Integrity Level:
UNKNOWN
12509/usr/lib/p7zip/7z l -slt -bd -y -- /home/user/Desktop/utorrent_installer.exe/usr/lib/p7zip/7z—file-roller
User:
user
Integrity Level:
UNKNOWN
Exit code:
482
Executable files
0
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
12463nautilus/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
12494file-roller/home/user/.local/share/recently-used.xbel.DDDGP2xml
MD5:—
SHA256:—
12494file-roller/home/user/.config/mimeapps.listtext
MD5:—
SHA256:—
12522gnome-disks/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
12494file-roller/home/user/.local/share/recently-used.xbelxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
7
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
470
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
12560
gvfsd-smb-browse
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
api.snapcraft.io
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
  • 185.125.188.58
unknown
130.100.168.192.in-addr.arpa
  • —
unknown
connectivity-check.ubuntu.com
  • 2620:2d:4000:1::2a
  • 2620:2d:4002:1::196
  • 2620:2d:4002:1::197
  • 2620:2d:4000:1::22
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::96
  • 2001:67c:1562::23
  • 2620:2d:4000:1::97
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
utorrent_installer.exe