torbrowser-install-8.0.6_es-ES.exe
Classification: Malicious
torbrowser-install-8.0.6_es-ES.exe is a malicious file sample. Linked to Tor malware. Reported by 1 threat source, last seen 2019-03-19.
Detection summary
- 1 antivirus detections (1% detection ratio)
- 1 IDS alerts
- 6 processes observed
- 12 contacted hosts
- 8 DNS requests
MITRE ATT&CK associations
Malware families: TOR (S0183)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Tor | Hybrid-Analysis | 2019-03-19 11:30:25 | 2019-03-19 11:30:25 | S0183 Tor |
Sample information
- Filenames
- torbrowser-install-8.0.6_es-ES.exe
- File type
- PE32 executable (GUI) Intel 80386 (stripped to ext ...
- Size
- 57752896 bytes
- MD5
d54d539de944a02106c2c85e0d392697- SHA-1
4c5548ff6a5c85924221a643c0ed3f4f0cd9e2e7- SHA-256
6f144f9be62264d2e962c9eeba0c306612a83485cded45cb5097980476401c35- First indexed
- 2019-03-19 11:30:25
- Last updated
- 2025-12-05 00:30:03
Antivirus detections
| Engine | Detection |
|---|---|
| Panda | HackingTool/Tor |
Network contacts
54.186.163.246 52.84.64.65 172.217.9.42 172.217.9.35 54.187.176.55 52.84.64.204 81.7.13.84 163.172.154.162 198.50.191.95 82.192.94.125 212.51.156.224 185.207.205.64
DNS requests
a1089.dscd.akamai.net cs9.wac.phicdn.net d1zkz3k4cclnv6.cloudfront.net dcky6u1m8u6el.cloudfront.net detectportal.firefox.com ocsp.pki.goog safebrowsing.googleapis.com shavar.prod.mozaws.net
Process list
| Name | Command line |
|---|---|
| torbrowser-install-8.0.6_es-ES.exe | |
| firefox.exe | |
| tor.exe | --defaults-torrc "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" -f "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" GeoIPFile "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" HashedControlPassword 16:5800c826b48bf6426023d7a0c602fbe83b70b8a0ac22e88b7fc9d1eee0 +__ControlPort 9151 +__SocksPort "127.0.0.1:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 3628 DisableNetwork 1 |
| firefox.exe | -contentproc --channel="3628.0.1571988449\1619207167" -childID 1 -isForBrowser -boolPrefs 300:0| -stringPrefs 286:38;{a32be4bd-f401-4fdc-9e6f-8570e87f4c56}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 3628 tab |
| firefox.exe | -contentproc --channel="3628.6.1671777719\514691408" -childID 2 -isForBrowser -boolPrefs 300:0| -stringPrefs 286:38;{a32be4bd-f401-4fdc-9e6f-8570e87f4c56}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 3628 tab |
| firefox.exe | -contentproc --channel="3628.12.38985986\1152483471" -childID 3 -isForBrowser -boolPrefs 300:0| -stringPrefs 286:38;{a32be4bd-f401-4fdc-9e6f-8570e87f4c56}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 3628 tab |