Report - acdbc24cd5f4…ecf81c2270

Malicious HighFILE

Quota 42

First seen: 2026-08-27T13:56:03Z
Last seen: 2026-11-11T10:21:32Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYbundleradware

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: acdbc24cd5f44b7e5cf85ba6e49b0b3a13529eb64ed9f29b4f8352ecf81c2270
SHA1: 7b4566eb98dd92a66a56645f2c3c82b84f13d84d
MD5: f0a46dad47ab0b950d9cfafa0dc21c2a
Filename: acdbc24c_utorrent_installer.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2155928
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections35%

VirusSign confidence100%

Relationship context20 visible

Threat classificationbundler

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

bc475d8c7bb2aab62adc06f7be24c7856d72ad80fe4a5c5b8c3996e9d03b2107

0% peexe 4378112 bytes drops

Filename bc475d8c_iwj8uco729qhuyp5.tmp.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 4378112 Compile time 2026-02-11T11:40:30Z

f6b86339ea9e79135202d66903e14a64c88b3d9ba3f0c7a6cb124412d44e637b

0% 73728 bytes contains

Filename f6b86339_.reloc.bin MIME application/octet-stream Size 73728 SHA1 e97b93417956f4e6813d6d419b8a2856b357509b First seen 2026-04-17T06:37:07Z

a01c87dd7c465d0284faabb9f3e7446455e686aed92b7cc650b069f745fdf5e9

0% 6656 bytes contains

Filename a01c87dd_.itext.bin MIME application/octet-stream Size 6656 SHA1 af6a5c7a136572f0a4266cf3901ed9b2d717383a First seen 2026-04-17T06:44:13Z

4d485808295e129e85b6546e0a8973619f9bee700c6b60671d7ecd71b55843cc

0% 719360 bytes contains

Filename 4d485808_.text.bin MIME application/octet-stream Size 719360 SHA1 0e58a8e84b1ccf14bea1848aad3276a06e9114a4 First seen 2026-04-17T06:48:10Z

f8bc31927074957901bc7975eec99aa54e759a66cbe2ca8bbbb16a2705caeedc

0% 512 bytes contains

Filename f8bc3192_.rdata.bin MIME application/octet-stream Size 512 SHA1 08fb7c36e037736171d75dff700936dd50e1e966 First seen 2026-04-17T06:33:38Z

Related IPs

Network IPs associated with this indicator.

5shown

216.239.32.181

5% low US communicates

CIDR 216.239.32.0/20 Network 216.239.32.0-216.239.63.255 First seen 2023-09-30T03:12:55Z Last seen 2026-11-15T04:02:44Z

3.165.160.11

0% US communicates

CIDR 3.128.0.0/10 Network 3.165.0.0-3.165.255.255 First seen 2024-08-30T10:45:01Z Last seen 2026-11-14T17:15:56Z

172.253.117.139

0% US communicates

CIDR 172.253.64.0/18 Network 172.253.0.0-172.253.255.255 First seen 2023-11-03T12:58:45Z Last seen 2026-11-15T04:08:03Z

172.253.117.138

0% US communicates

CIDR 172.253.64.0/18 Network 172.253.0.0-172.253.255.255 First seen 2023-11-03T12:58:45Z Last seen 2026-11-15T04:08:03Z

172.253.117.113

0% US communicates

CIDR 172.253.64.0/18 Network 172.253.0.0-172.253.255.255 First seen 2023-11-03T12:58:45Z Last seen 2026-11-15T04:08:03Z

Related domains

Domains associated with this indicator.

5shown

utorrent.com

0% .com communicates

Root utorrent.com TLD com First seen 2023-09-29T21:15:33Z Last seen 2026-11-15T02:33:45Z

utclient.utorrent.com

0% .com communicates

Root utorrent.com TLD com Subdomain utclient First seen 2023-10-01T02:56:57Z Last seen 2026-11-14T18:15:57Z

update.utorrent.com

0% .com communicates

Root utorrent.com TLD com Subdomain update First seen 2023-09-29T14:17:35Z Last seen 2026-11-15T02:33:45Z

update.bittorrent.com

0% .com communicates

Root bittorrent.com TLD com Subdomain update First seen 2023-09-28T17:55:57Z Last seen 2026-11-15T00:44:47Z

router.utorrent.com

0% .com communicates

Root utorrent.com TLD com Subdomain router First seen 2023-09-30T10:07:22Z Last seen 2026-11-15T04:27:04Z

Related URLs

URLs associated with this indicator.

5shown

http://i-38.b-47254.ut.bench.utorrent.com/e?…

0% communicates

TLD com HTTP status 400 Content length 82 Content SHA256 7ba5c11561c8d1c2b788aea36dc2136d2623f318987ee345b7bc0a7ecbe94e5d First seen 2026-05-16T18:08:34Z

http://i-49.b-47254.ut.bench.utorrent.com/e?…

0% communicates

TLD com HTTP status 400 Content length 82 Content SHA256 7ba5c11561c8d1c2b788aea36dc2136d2623f318987ee345b7bc0a7ecbe94e5d First seen 2026-05-18T12:15:22Z

http://i-43.b-47254.ut.bench.utorrent.com/e?…

0% communicates

TLD com HTTP status 400 Content length 82 Content SHA256 7ba5c11561c8d1c2b788aea36dc2136d2623f318987ee345b7bc0a7ecbe94e5d First seen 2026-05-18T12:15:22Z

http://i-61.b-47254.ut.bench.utorrent.com/e?…

0% communicates

TLD com HTTP status 400 Content length 82 Content SHA256 7ba5c11561c8d1c2b788aea36dc2136d2623f318987ee345b7bc0a7ecbe94e5d First seen 2026-05-18T12:15:22Z

http://i-62.b-47254.ut.bench.utorrent.com/e?…

0% communicates

TLD com HTTP status 400 Content length 82 Content SHA256 7ba5c11561c8d1c2b788aea36dc2136d2623f318987ee345b7bc0a7ecbe94e5d First seen 2026-05-16T18:08:34Z

Analysis details

Severity: highadwaredebug-checkexefile-overlayexec-delayadapter-discoveryobfuscatedpersistenceself-deletesigned

Freshness: Fresh · Last seen 3 days ago.

Detection rate: 35%
Threat type: adware
Family: bundler
Confidence: 100%
detection: 35 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: acdbc24cd5f44b7e5cf85ba6e49b0b3a13529eb64ed9f29b4f8352ecf81c2270
SHA1: 7b4566eb98dd92a66a56645f2c3c82b84f13d84d
MD5: f0a46dad47ab0b950d9cfafa0dc21c2a
Filename: acdbc24c_utorrent_installer.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2155928
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11
Import libraries: 5
TLSH: T17EA5CF3BB28B753EE06A5A3A7A76D210583F6E6165134C06D6E4D88CCF350B01E3E797
SSDEEP: 24576:gXNrSLScusMmOvjjhzvLJyKRaPzA1VeQ/+g0Fi4ETLRXuFU6zj8GXYL5GfrIwiCR:fuI2hGPs1l+g0Fi4cRXMsm4MfrIpCqs
Imphash: 88016fcdef7f227c62171d0afad9aae4
First seen: 2026-08-27T13:56:03Z
Last seen: 2026-11-11T10:21:32Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type adware and family bundler.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2023-09-28 to 2026-05-18. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 35%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification bundler

Classification context: type adware, family bundler.

Intelligence freshness Fresh

Last seen 3 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: acdbc24c_utorrent_installer.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 2155928
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
Entry point: 728672
Sections: 11

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

adapter-discoverydebug-checkexec-delayobfuscatedpersistenceself-delete

View details · 5 shown

A named pipe was used for inter-process communication
Attempts to connect to a dead IP:Port
Attempts to query display device information, possibly to determine if the process is running in a virtualized environment
Checks adapter addresses which can be used to detect virtual network interfaces
Checks available memory

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — A named pipe was used for inter-process communication
Tactics: TA0011
T1082 — Attempts to query display device information, possibly to determine if the process is running in a virtualized environment
Tactics: TA0007
T1055 — Contains .tls (Thread Local Storage) section
Tactics: TA0004 · TA0005
T1070 — Deletes executed files from disk
Tactics: TA0005
T1129 — Drops a binary and executes it
Tactics: TA0002

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0030 — C2 Communication
Objectives: OB0004
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTP, UDPports 443, 80, 123

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 123, 6881, 1900
Protocols: TCP, HTTP, UDP

View details · 5 shown

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 239.255.255.250
Port: 1900
Protocol: UDP

IP: 224.0.0.252
Port: 5355
Protocol: UDP

IP: 216.239.32.181
Port: 443
Protocol: TCP

IP: 172.253.117.132
Port: 443
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: router.bittorrent.com
Type: A
Answers: 67.215.246.10
Response: NOERROR

Query: clients2.googleusercontent.com
Type: A
Answers: 172.253.117.132
Response: NOERROR

Query: xpaywalletcdn.azureedge.net
Type: A
Answers: 150.171.110.147
Response: NOERROR

Query: www.utorrent.com
Type: A
Answers: 3.165.160.37, 3.165.160.91, 3.165.160.86, 3.165.160.106
Response: NOERROR

Query: www.googletagmanager.com

5 shown

C2 candidates2

UDPports 6881

2 C2 candidate communications
0 domains, 2 IPs
Common ports: 6881
Protocols: UDP

View details · 2 shown

IP: 82.221.103.244
Port: 6881
Protocol: UDP

IP: 67.215.246.10
Port: 6881
Protocol: UDP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2026-02-11T11:40:27Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 728672
Sections: 11
Compile time: 2026-02-11T11:40:27Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, r, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 718860
Raw size: 719360
Permissions: rx
Entropy: 6.38

Name: .itext
Virtual address: 724992
Virtual size: 6348
Raw size: 6656
Permissions: rx
Entropy: 6.04

Name: .data
Virtual address: 733184
Virtual size: 16188
Raw size: 16384
Permissions: rw
Entropy: 5.18

Name: .bss
Virtual address: 749568
Virtual size: 29516
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 782336
Virtual size: 4200
Raw size: 4608
Permissions: rw
Entropy: 4.82

5 shown

Imports5

5 DLL groups

5 import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: kernel32.dll
Functions: CloseHandle, CompareStringOrdinal, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileW, CreateProcessW, CreateThread …

Library: comctl32.dll
Functions: InitCommonControls

Library: user32.dll
Functions: CallWindowProcW, CharLowerBuffW, CharNextW, CharUpperBuffW, CharUpperW, CreateWindowExW, DestroyWindow, DispatchMessageW …

Library: oleaut32.dll
Functions: SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayUnaccessData …

Library: advapi32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, EqualSid, FreeSid, GetTokenInformation, LookupPrivilegeValueW …

Exports2

2 exported items

2 exported items

View details · 2 shown

Name: __dbk_fcall_wrapper

Name: dbkFCallWrapperAddr

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_STRING
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_RCDATA
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: RainCo HK Limited
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2026-07-07 – 2027-07-06

View details · 5 shown

Subject: RainCo HK Limited
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1783382400.0
Valid to: 1814918340.0
Fingerprint: 8EFC39E3D535D6FC9B4E7963D9F07DE37D696154

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Valid from: 1659312000.0
Valid to: 1952035140.0
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert
Issuer: DigiCert Assured ID Root CA
Valid from: 1163116800.0
Valid to: 1952035200.0
Fingerprint: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

Subject: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1
Issuer: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Fingerprint: DD6230AC860A2D306BDA38B16879523007FB417E

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check