torbrowser-install-8.0.4_en-US.exe
Classification: Malicious
torbrowser-install-8.0.4_en-US.exe is a malicious file sample. Linked to Tor malware. Reported by 1 threat source, last seen 2019-02-04.
Detection summary
- 1 antivirus detections (1% detection ratio)
- 1 IDS alerts
- 4 processes observed
- 32 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: TOR (S0183)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Tor | Hybrid-Analysis | 2019-02-04 01:15:04 | 2019-02-04 01:15:04 | S0183 Tor |
Sample information
- Filenames
- torbrowser-install-8.0.4_en-US.exe
- File type
- PE32 executable (GUI) Intel 80386 (stripped to ext ...
- Size
- 57547088 bytes
- MD5
1c9ca0f26c72e2448f64931c92c08a34- SHA-1
ca2fa979e767d7210cf5d15ac5e4acd342270c17- SHA-256
fcf5578d459ce0f906edcbebbf08a5a9d9e53763945f39605106daaec40fdc02- First indexed
- 2019-02-04 01:15:04
- Last updated
- 2026-04-04 14:42:20
Antivirus detections
| Engine | Detection |
|---|---|
| Panda | HackingTool/Tor |
Network contacts
184.150.163.34 184.29.117.177 217.79.179.177 176.126.252.11 85.25.159.65 193.11.114.43 91.229.20.27 31.171.155.108 185.100.85.101 66.111.2.20 46.165.230.5 81.7.14.253 163.172.176.167 213.141.138.174 81.7.16.182 163.172.138.22 212.129.62.232 171.25.193.77 199.249.223.40 199.249.223.43 195.154.164.243 86.59.119.83 178.62.60.37 94.130.186.5 104.200.20.46 46.101.169.151 212.47.233.86 185.100.84.82 212.47.233.250 185.100.85.61 199.249.223.66 163.172.25.118
Process list
| Name | Command line |
|---|---|
| torbrowser-install-8.0.4_en-US.exe | |
| firefox.exe | |
| tor.exe | --defaults-torrc "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" -f "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" GeoIPFile "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "%USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" HashedControlPassword 16:5dfc3d133a390e5e60be1f47be1aa282d8b048af9588fce5a2f9bca6fa +__ControlPort 9151 +__SocksPort "127.0.0.1:9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 2968 DisableNetwork 1 |
| firefox.exe | -contentproc --channel="2968.0.1896809750\1955403528" -childID 1 -isForBrowser -boolPrefs 299:0| -stringPrefs 285:38;{e7c39b5a-f61b-44c1-ae07-80b9e74f21ca}| -schedulerPrefs 0001,2 -greomni "%USERPROFILE%\Desktop\Tor Browser\Browser\omni.ja" -appomni "%USERPROFILE%\Desktop\Tor Browser\Browser\browser\omni.ja" -appdir "%USERPROFILE%\Desktop\Tor Browser\Browser\browser" 2968 tab |