| File name: | bitelchus-bitelchus--2024---BluRay-1080p_30_1029.torrent |
| Full analysis: | https://app.any.run/tasks/fa2773a9-0743-40d7-afb0-6d120d7f27ee |
| Verdict: | Malicious activity |
| Analysis date: | October 10, 2024, 18:01:05 |
| OS: | Ubuntu 22.04.2 |
| MIME: | application/x-bittorrent |
| File info: | BitTorrent file |
| MD5: | 81DA1C2ADEC96A578A38CD2FE80B0111 |
| SHA1: | 31A177D6474269BB8F090304A96D72F9236A616D |
| SHA256: | E6D3E210FB5CAF7BEFF0E1E767533268FBEAF22B634135D83ADF6A28D272F3A1 |
| SSDEEP: | 6144:zP/o+1/8YQIS1ZAwD/KgGvNcEpN91iVsMHY3ikcTaxudNOt:bwc/9LwD//GuEpEz0ikcm+Ut |
| .torrent | | | Torrent (trackerless) (57.6) |
|---|---|---|
| .torrent | | | Torrent (42.3) |
| Announce: | http://173.254.204.71:1096/announce |
|---|---|
| AnnounceList1: | http://173.254.204.71:1096/announce |
| AnnounceList2: | http://182.176.139.129:6969/announce |
| AnnounceList3: | http://5.79.83.193:2710/announce |
| AnnounceList4: | http://91.217.91.21:3218/announce |
| AnnounceList5: | http://explodie.org:6969/announce |
| AnnounceList6: | http://mgtracker.org:2710/announce |
| AnnounceList7: | http://mgtracker.org:6969/announce |
| AnnounceList8: | http://open.acgtracker.com:1096/announce |
| AnnounceList9: | http://tracker.edoardocolombo.eu:6969/announce |
| AnnounceList10: | http://tracker.internetwarriors.net:1337/announce |
| AnnounceList11: | http://tracker.kamigami.org:2710/announce |
| AnnounceList12: | http://tracker.mg64.net:6881/announce |
| AnnounceList13: | http://tracker.tfile.me/announce |
| AnnounceList14: | http://tracker.tvunderground.org.ru:3218/announce |
| AnnounceList15: | http://tracker2.itzmx.com:6961/announce |
| AnnounceList16: | http://tracker3.itzmx.com:6961/announce |
| AnnounceList17: | udp://151.80.120.114:2710/announce |
| AnnounceList18: | udp://182.176.139.129:6969/announce |
| AnnounceList19: | udp://5.79.83.193:6969/announce |
| AnnounceList20: | udp://62.138.0.158:6969/announce |
| AnnounceList21: | udp://9.rarbg.com:2710/announce |
| AnnounceList22: | udp://9.rarbg.me:2780/announce |
| AnnounceList23: | udp://9.rarbg.to:2710/announce |
| AnnounceList24: | udp://9.rarbg.to:2730/announce |
| AnnounceList25: | udp://bt.xxx-tracker.com:2710/announce |
| AnnounceList26: | udp://exodus.desync.com:6969 |
| AnnounceList27: | udp://exodus.desync.com:6969/announce |
| AnnounceList28: | udp://explodie.org:6969/announce |
| AnnounceList29: | udp://ipv4.tracker.harry.lu:80/announce |
| AnnounceList30: | udp://mgtracker.org:2710/announce |
| AnnounceList31: | udp://open.demonii.si:1337/announce |
| AnnounceList32: | udp://open.stealth.si:80/announce |
| AnnounceList33: | udp://public.popcorn-tracker.org:6969 |
| AnnounceList34: | udp://public.popcorn-tracker.org:6969/announce |
| AnnounceList35: | udp://retracker.lanta-net.ru:2710/announce |
| AnnounceList36: | udp://tracker.coppersurfer.tk:1337/announce |
| AnnounceList37: | udp://tracker.coppersurfer.tk:6969 |
| AnnounceList38: | udp://tracker.coppersurfer.tk:6969/announce |
| AnnounceList39: | udp://tracker.coppersurfer.tk/announce |
| AnnounceList40: | udp://tracker.internetwarriors.net:1337/announce |
| AnnounceList41: | udp://tracker.mg64.net:2710/announce |
| AnnounceList42: | udp://tracker.mg64.net:6969/announce |
| AnnounceList43: | udp://tracker.opentrackr.org:1337 |
| AnnounceList44: | udp://tracker.opentrackr.org:1337/announce |
| AnnounceList45: | udp://tracker.port443.xyz:6969/announce |
| AnnounceList46: | udp://tracker.tiny-vps.com:6969/announce |
| AnnounceList47: | udp://tracker.torrent.eu.org:451/announce |
| AnnounceList48: | udp://tracker.uw0.xyz:6969/announce |
| AnnounceList49: | udp://tracker.vanitycore.co:6969/announce |
| AnnounceList50: | udp://tracker1.itzmx.com:8080/announce |
| AnnounceList51: | http://104.28.1.30:8080/announce |
| AnnounceList52: | http://104.28.16.69/announce |
| AnnounceList53: | http://107.150.14.110:6969/announce |
| AnnounceList54: | http://109.121.134.121:1337/announce |
| AnnounceList55: | http://114.55.113.60:6969/announce |
| AnnounceList56: | http://125.227.35.196:6969/announce |
| AnnounceList57: | http://128.199.70.66:5944/announce |
| AnnounceList58: | http://157.7.202.64:8080/announce |
| AnnounceList59: | http://158.69.146.212:7777/announce |
| AnnounceList60: | http://178.175.143.27/announce |
| AnnounceList61: | http://178.33.73.26:2710/announce |
| AnnounceList62: | http://185.5.97.139:8089/announce |
| AnnounceList63: | http://188.165.253.109:1337/announce |
| AnnounceList64: | http://194.106.216.222/announce |
| AnnounceList65: | http://195.123.209.37:1337/announce |
| AnnounceList66: | http://210.244.71.25:6969/announce |
| AnnounceList67: | http://210.244.71.26:6969/announce |
| AnnounceList68: | http://213.159.215.198:6970/announce |
| AnnounceList69: | http://213.163.67.56:1337/announce |
| AnnounceList70: | http://37.19.5.139:6969/announce |
| AnnounceList71: | http://37.19.5.155:6881/announce |
| AnnounceList72: | http://46.4.109.148:6969/announce |
| AnnounceList73: | http://5.79.249.77:6969/announce |
| AnnounceList74: | http://51.254.244.161:6969/announce |
| AnnounceList75: | http://59.36.96.77:6969/announce |
| AnnounceList76: | http://74.82.52.209:6969/announce |
| AnnounceList77: | http://80.246.243.18:6969/announce |
| AnnounceList78: | http://81.200.2.231/announce |
| AnnounceList79: | http://85.17.19.180/announce |
| AnnounceList80: | http://87.248.186.252:8080/announce |
| AnnounceList81: | http://87.253.152.137/announce |
| AnnounceList82: | http://91.216.110.47/announce |
| AnnounceList83: | http://91.218.230.81:6969/announce |
| AnnounceList84: | http://93.92.64.5/announce |
| AnnounceList85: | http://atrack.pow7.com/announce |
| AnnounceList86: | http://bt.henbt.com:2710/announce |
| AnnounceList87: | http://bt.pusacg.org:8080/announce |
| AnnounceList88: | http://bt2.careland.com.cn:6969/announce |
| AnnounceList89: | http://open.lolicon.eu:7777/announce |
| AnnounceList90: | http://open.touki.ru/announce.php |
| AnnounceList91: | http://p4p.arenabg.ch:1337/announce |
| AnnounceList92: | http://p4p.arenabg.com:1337/announce |
| AnnounceList93: | http://pow7.com:80/announce |
| AnnounceList94: | http://retracker.gorcomnet.ru/announce |
| AnnounceList95: | http://retracker.krs-ix.ru/announce |
| AnnounceList96: | http://retracker.krs-ix.ru:80/announce |
| AnnounceList97: | http://secure.pow7.com/announce |
| AnnounceList98: | http://t1.pow7.com/announce |
| AnnounceList99: | http://t2.pow7.com/announce |
| AnnounceList100: | http://thetracker.org:80/announce |
| AnnounceList101: | http://torrent.gresille.org/announce |
| AnnounceList102: | http://torrentsmd.com:8080/announce |
| AnnounceList103: | http://tracker.aletorrenty.pl:2710/announce |
| AnnounceList104: | http://tracker.baravik.org:6970/announce |
| AnnounceList105: | http://tracker.bittor.pw:1337/announce |
| AnnounceList106: | http://tracker.bittorrent.am/announce |
| AnnounceList107: | http://tracker.calculate.ru:6969/announce |
| AnnounceList108: | http://tracker.dler.org:6969/announce |
| AnnounceList109: | http://tracker.dutchtracking.com/announce |
| AnnounceList110: | http://tracker.dutchtracking.com:80/announce |
| AnnounceList111: | http://tracker.dutchtracking.nl/announce |
| AnnounceList112: | http://tracker.dutchtracking.nl:80/announce |
| AnnounceList113: | http://tracker.ex.ua/announce |
| AnnounceList114: | http://tracker.ex.ua:80/announce |
| AnnounceList115: | http://tracker.filetracker.pl:8089/announce |
| AnnounceList116: | http://tracker.flashtorrents.org:6969/announce |
| AnnounceList117: | http://tracker.grepler.com:6969/announce |
| AnnounceList118: | http://tracker.kicks-ass.net/announce |
| AnnounceList119: | http://tracker.kicks-ass.net:80/announce |
| AnnounceList120: | http://tracker.kuroy.me:5944/announce |
| AnnounceList121: | http://tracker.opentrackr.org:1337/announce |
| AnnounceList122: | http://tracker.skyts.net:6969/announce |
| AnnounceList123: | http://tracker.tiny-vps.com:6969/announce |
| AnnounceList124: | http://tracker.yoshi210.com:6969/announce |
| AnnounceList125: | http://tracker1.wasabii.com.tw:6969/announce |
| AnnounceList126: | http://tracker2.wasabii.com.tw:6969/announce |
| AnnounceList127: | http://www.wareztorrent.com/announce |
| AnnounceList128: | http://www.wareztorrent.com:80/announce |
| AnnounceList129: | https://104.28.17.69/announce |
| AnnounceList130: | https://www.wareztorrent.com/announce |
| AnnounceList131: | udp://107.150.14.110:6969/announce |
| AnnounceList132: | udp://109.121.134.121:1337/announce |
| AnnounceList133: | udp://114.55.113.60:6969/announce |
| AnnounceList134: | udp://128.199.70.66:5944/announce |
| AnnounceList135: | udp://168.235.67.63:6969/announce |
| AnnounceList136: | udp://178.33.73.26:2710/announce |
| AnnounceList137: | udp://185.5.97.139:8089/announce |
| AnnounceList138: | udp://185.86.149.205:1337/announce |
| AnnounceList139: | udp://188.165.253.109:1337/announce |
| AnnounceList140: | udp://191.101.229.236:1337/announce |
| AnnounceList141: | udp://194.106.216.222:80/announce |
| AnnounceList142: | udp://195.123.209.37:1337/announce |
| AnnounceList143: | udp://195.123.209.40:80/announce |
| AnnounceList144: | udp://208.67.16.113:8000/announce |
| AnnounceList145: | udp://213.163.67.56:1337/announce |
| AnnounceList146: | udp://37.19.5.155:2710/announce |
| AnnounceList147: | udp://46.4.109.148:6969/announce |
| AnnounceList148: | udp://5.79.249.77:6969/announce |
| AnnounceList149: | udp://51.254.244.161:6969/announce |
| AnnounceList150: | udp://62.212.85.66:2710/announce |
| AnnounceList151: | udp://74.82.52.209:6969/announce |
| AnnounceList152: | udp://85.17.19.180:80/announce |
| AnnounceList153: | udp://89.234.156.205:80/announce |
| AnnounceList154: | udp://91.218.230.81:6969/announce |
| AnnounceList155: | udp://94.23.183.33:6969/announce |
| AnnounceList156: | udp://eddie4.nl:6969/announce |
| AnnounceList157: | udp://p4p.arenabg.com:1337/announce |
| AnnounceList158: | udp://shadowshq.eddie4.nl:6969/announce |
| AnnounceList159: | udp://shadowshq.yi.org:6969/announce |
| AnnounceList160: | udp://torrent.gresille.org:80/announce |
| AnnounceList161: | udp://tracker.aletorrenty.pl:2710/announce |
| AnnounceList162: | udp://tracker.bittor.pw:1337/announce |
| AnnounceList163: | udp://tracker.eddie4.nl:6969/announce |
| AnnounceList164: | udp://tracker.ex.ua:80/announce |
| AnnounceList165: | udp://tracker.filetracker.pl:8089/announce |
| AnnounceList166: | udp://tracker.flashtorrents.org:6969/announce |
| AnnounceList167: | udp://tracker.grepler.com:6969/announce |
| AnnounceList168: | udp://tracker.ilibr.org:80/announce |
| AnnounceList169: | udp://tracker.kicks-ass.net:80/announce |
| AnnounceList170: | udp://tracker.kuroy.me:5944/announce |
| AnnounceList171: | udp://tracker.leechers-paradise.org:6969/announce |
| AnnounceList172: | udp://tracker.piratepublic.com:1337/announce |
| AnnounceList173: | udp://tracker.sktorrent.net:6969/announce |
| AnnounceList174: | udp://tracker.skyts.net:6969/announce |
| AnnounceList175: | udp://tracker.yoshi210.com:6969/announce |
| AnnounceList176: | udp://tracker2.indowebster.com:6969/announce |
| AnnounceList177: | udp://tracker4.piratux.com:6969/announce |
| AnnounceList178: | udp://zer0day.ch:1337/announce |
| AnnounceList179: | udp://zer0day.to:1337/announce |
| Creator: | qBittorrent v4.5.4 |
| CreateDate: | 2024:10:09 04:44:34+00:00 |
| File1Length: | 8.3 GiB |
| File1Path: | Bitelchus Bitelchus (2024) [Bluray 1080p][Esp](wolfmax4k.com).mkv |
| Name: | Bitelchus Bitelchus (2024) [Bluray 1080p][Esp] |
| PieceLength: | 1048576 |
| Pieces: | (Binary data 169740 bytes, use -b option to extract) |
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 425 | /lib/systemd/systemd-resolved | /usr/lib/systemd/systemd-resolved | systemd | |
User: systemd-resolve Integrity Level: UNKNOWN | ||||
| 13905 | /bin/sh -c "DISPLAY=:0 sudo -iu user transmission-gtk /tmp/bitelchus-bitelchus--2024---BluRay-1080p_30_1029\.torrent " | /bin/sh | — | any-guest-agent |
User: user Integrity Level: UNKNOWN Exit code: 14418 | ||||
| 13906 | sudo -iu user transmission-gtk /tmp/bitelchus-bitelchus--2024---BluRay-1080p_30_1029.torrent | /usr/bin/sudo | — | sh |
User: user Integrity Level: UNKNOWN Exit code: 14418 | ||||
| 13907 | systemctl --user --global is-enabled snap.snapd-desktop-integration.snapd-desktop-integration.service | /usr/bin/systemctl | — | snapd |
User: root Integrity Level: UNKNOWN Exit code: 0 | ||||
| 13908 | transmission-gtk /tmp/bitelchus-bitelchus--2024---BluRay-1080p_30_1029.torrent | /usr/bin/transmission-gtk | sudo | |
User: user Integrity Level: UNKNOWN Exit code: 14418 | ||||
| 13909 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | transmission-gtk |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
| 13936 | /lib/systemd/systemd-hostnamed | /lib/systemd/systemd-hostnamed | — | systemd |
User: root Integrity Level: UNKNOWN Exit code: 418 | ||||
| 13941 | /usr/libexec/gvfsd-network --spawner :1.6 /org/gtk/gvfs/exec_spaw/1 | /usr/libexec/gvfsd-network | — | gvfsd |
User: user Integrity Level: UNKNOWN | ||||
| 13947 | /usr/libexec/gvfsd-smb-browse --spawner :1.6 /org/gtk/gvfs/exec_spaw/2 | /usr/libexec/gvfsd-smb-browse | gvfsd | |
User: user Integrity Level: UNKNOWN Exit code: 482 | ||||
| 13955 | /usr/libexec/gvfsd-dnssd --spawner :1.6 /org/gtk/gvfs/exec_spaw/3 | /usr/libexec/gvfsd-dnssd | — | gvfsd |
User: user Integrity Level: UNKNOWN | ||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 13908 | transmission-gtk | /home/user/.config/transmission/torrents/4f6b94f3ad43cee61301d30c6f8d2a9d6b7ac227.torrent | torrent | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.config/transmission/settings.json | binary | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/yoshi210.com (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/ilibr.org (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/zer0day.ch (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/torrentsmd.com (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/opentrackr.org | image | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/grepler.com (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/rarbg.me (deleted) | html | |
MD5:— | SHA256:— | |||
| 13908 | transmission-gtk | /home/user/.cache/transmission/favicons/tfile.me (deleted) | html | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 204 | 185.125.190.17:80 | http://connectivity-check.ubuntu.com/ | unknown | — | — | whitelisted |
13908 | transmission-gtk | GET | 302 | 46.166.189.98:80 | http://xxx-tracker.com/favicon.ico | unknown | — | — | whitelisted |
13908 | transmission-gtk | GET | 302 | 104.21.52.21:80 | http://thetracker.org/favicon.ico | unknown | — | — | whitelisted |
13908 | transmission-gtk | GET | 410 | 13.248.252.114:80 | http://yoshi210.com/favicon.ico | unknown | — | — | unknown |
13908 | transmission-gtk | GET | 403 | 188.114.96.3:80 | http://torrentsmd.com/favicon.ico | unknown | — | — | whitelisted |
13908 | transmission-gtk | GET | 200 | 199.59.243.227:80 | http://tfile.me/favicon.ico | unknown | — | — | unknown |
13908 | transmission-gtk | GET | 301 | 188.114.97.3:80 | http://kuroy.me/favicon.ico | unknown | — | — | whitelisted |
13908 | transmission-gtk | GET | 200 | 199.59.243.227:80 | http://rarbg.me/favicon.ico | unknown | — | — | unknown |
13908 | transmission-gtk | GET | 200 | 85.94.194.169:80 | http://zer0day.ch/favicon.ico | unknown | — | — | unknown |
13908 | transmission-gtk | GET | 410 | 99.83.138.213:80 | http://ilibr.org/favicon.ico | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
470 | avahi-daemon | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 91.189.91.98:80 | connectivity-check.ubuntu.com | Canonical Group Limited | US | whitelisted |
— | — | 212.102.56.178:443 | odrs.gnome.org | Datacamp Limited | DE | whitelisted |
— | — | 185.125.190.17:80 | connectivity-check.ubuntu.com | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.188.54:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
— | — | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
485 | snapd | 185.125.188.55:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
485 | snapd | 185.125.188.59:443 | api.snapcraft.io | Canonical Group Limited | GB | whitelisted |
13908 | transmission-gtk | 239.255.255.250:1900 | — | — | — | whitelisted |
Domain | IP | Reputation |
|---|---|---|
connectivity-check.ubuntu.com |
| whitelisted |
google.com |
| whitelisted |
odrs.gnome.org |
| whitelisted |
api.snapcraft.io |
| whitelisted |
121.100.168.192.in-addr.arpa |
| unknown |
xxx-tracker.com |
| whitelisted |
vanitycore.co |
| unknown |
yi.org |
| unknown |
uw0.xyz |
| unknown |
zer0day.to |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
13908 | transmission-gtk | Potential Corporate Privacy Violation | ET P2P Vuze BT UDP Connection (5) |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |
425 | systemd-resolved | Potentially Bad Traffic | ET DNS Query for .to TLD |