torbrowser-install-8.0.7_ru.exe
Classification: Malicious
torbrowser-install-8.0.7_ru.exe is a malicious file sample. Linked to Tor malware. Reported by 1 threat source, last seen 2019-03-22.
Detection summary
- 3 antivirus detections (1% detection ratio)
- 0 IDS alerts
- 5 processes observed
- 32 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: TOR (S0183)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Tor | Hybrid-Analysis | 2019-03-22 14:01:55 | 2019-03-22 14:01:55 | S0183 Tor |
Sample information
- Filenames
- torbrowser-install-8.0.7_ru.exe
- File type
- PE32 executable (GUI) Intel 80386 (stripped to ext ...
- Size
- 57963336 bytes
- MD5
5d6a5be95f658448fb089c190d572031- SHA-1
13525fa297e5d51aa0be1d86fa3c5487ffd2ec55- SHA-256
fbe30ffa3062e232f1e47cc29030922ee0e9a2ad44d03fb4cd235d6e027de734- First indexed
- 2019-03-22 14:01:55
- Last updated
- 2025-09-01 05:53:36
Antivirus detections
| Engine | Detection |
|---|---|
| Panda | HackingTool/Tor |
| Antiy-AVL | Trojan/Win32.Wacatac |
| VBA32 | BScope.Trojan.Downloader |
Network contacts
193.234.15.57 46.165.230.5 171.25.193.9 46.28.110.244 131.188.40.189 37.187.115.157 193.23.244.244 85.25.213.211 204.13.164.118 54.37.17.235 178.17.170.156 154.35.175.225 213.239.217.18 193.11.114.45 128.31.0.39 37.187.22.87 192.87.28.82 86.59.21.38 185.220.101.9 194.109.206.212 199.58.81.140 176.10.104.240 46.38.237.221 195.154.164.243 188.40.128.246 86.105.212.130 204.8.156.142 192.160.102.166 91.229.20.27 37.252.185.182 31.185.104.19 217.12.199.190
Process list
| Name | Command line |
|---|---|
| torbrowser-install-8.0.7_ru.exe | |
| firefox.exe | |
| tor.exe | --defaults-torrc "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" -f "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" GeoIPFile "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" HashedControlPassword 16:c0a3b28ec48c3516606eca61a322a1f5817b3145c7415463405ca892e5 +__ControlPort 9151 +__SocksPort "127.0.0.1:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 4056 DisableNetwork 1 |
| firefox.exe | -contentproc --channel="4056.0.1310079096\970621888" -childID 1 -isForBrowser -boolPrefs 301:0| -stringPrefs 287:38;{be338e1e-30c2-42a7-92ab-c1354b9c6d1d}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 4056 tab |
| firefox.exe | -contentproc --channel="4056.6.308845392\679064842" -childID 2 -isForBrowser -boolPrefs 301:0| -stringPrefs 287:38;{be338e1e-30c2-42a7-92ab-c1354b9c6d1d}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 4056 tab |