File scan report

Verdict Suspicious

Analyzed Sep 7, 20261 month ago

Is utorrent_installer 3.6.0.exe safe? Treat it as suspicious.

uTorrent installer signed by Rainberry Inc but flagged by 6 major antivirus engines as OfferCore unwanted program with credential-access behaviour.

Read the whole reasonShow less

Why Suspicious? 16 antivirus engines flag it and one of our detection rules matched it.

Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.

Don't install it until you know where it came from

Treat as unwanted software; obtain uTorrent from official channels instead of third-party bundles.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.

If you already installed it

Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

16 of 72 flagged

Flagged 16
No detection 56
No result 4

Fileutorrent_installer 3.6.0.exe1.7 MBSHA-256 2c39da852322…099115

Code signing Rainberry Inc
Test run Completed
First seen 3y ago

16 of the 72 antivirus engines that checked it flag it, including Microsoft and ESET.

Chapter 02

Why we think so

2 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

Six major antivirus engines and four agreeing on the OfferCore family label this file malicious.

Where this verdict could be wrong2 caveats

contactedHosts.inspected=17, maliciousHosts.length=0 — no complete contacted-host reputation result was available contacted.
No dropped file is known to be malicious, 10 children inspected with no malicious verdicts.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

55sandbox rule tags
10spawned processes
37network contacts
40filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

High concern: Set a trigger that runs code when something else happens.
Moderate concern: Created a scheduled task so it runs again later.
Moderate concern: Created a Windows service so it keeps running.
Moderate concern: Set itself to start automatically after a restart.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Downloaded a file during the test run.

Sandbox labels we could not confirm (common in safe files too)

Not confirmed: A sandbox rule tagged this run as password-store access, but nothing touched the Windows password store.
Not confirmed: Showed activity a sandbox rule links to file encryption; no ransomware behaviour was confirmed.
Not confirmed: A sandbox rule tagged this run as searching for passwords; no password file was read.
Not confirmed: A sandbox rule tagged this run as reading saved logins; no login store was opened.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

Input file
The submitted object
1
1. Evidence 1 of 7: FileSeen in the test run
  utorrent_installer 3.6.0.exe
  2c39da85232292347d60c0a0ac3ee372e5c6f1b47e25a2ca740a8339e6099115
  Uploaded file
Processes
What ran
2
1. Evidence 2 of 7: ProcessSeen in the test run
  software.exe
  "C:\Users\<USER>\Desktop\software.exe"
  Test run
2. Evidence 3 of 7: ProcessSeen in the test run
  software.tmp
  "C:\Users\<USER>\AppData\Local\Temp\is-AEI8K.tmp\software.tmp" /SL5="$2019C,837769,816128,C:\Users\<USER>\Desktop\software.exe"
  Test run
3. +1 more recorded observation
Files
Created or changed
2
1. Evidence 4 of 7: Written fileSeen in the test run
  software.tmp
  C:\Users\<USER>\AppData\Local\Temp\is-AEI8K.tmp\software.tmp
  Test run
2. Evidence 5 of 7: Written fileSeen in the test run
  _setup64.tmp
  C:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\_isetup\_setup64.tmp
  Test run
3. +1 more recorded observation
Network
Hosts contacted
2
1. Evidence 6 of 7: Contacted hostSeen in the test run
  18.154.99.69
  Contacted during the test run.
  Test run
2. Evidence 7 of 7: Contacted hostSeen in the test run
  54.230.17.224
  Contacted during the test run.
  Test run
3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1003· Credential theft
T1005
T1012
T1016· Network recon
T1018
T1027· Obfuscated code
T1027.002· Obfuscated code
T1033· Reads user info
T1036
T1045
T1047
T1053· Scheduled task
T1057· Lists programs
T1059· Runs commands
T1060
T1064
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1105· Network file transfer
T1106
T1112
T1114
T1129· Loads modules
T1134
T1140· Deobfuscation
T1143
T1485
T1486· File encryption
T1497· Sandbox evasion
T1518· Checks your AV
+23 more

Observed activity

Processes started

Programs the file ran, with their command lines.

software.exe"C:\Users\<USER>\Desktop\software.exe"
software.tmp"C:\Users\<USER>\AppData\Local\Temp\is-AEI8K.tmp\software.tmp" /SL5="$2019C,837769,816128,C:\Users\<USER>\Desktop\software.exe"
uTorrent.exe"C:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
utorrent.exe"C:\Users\<USER>\AppData\Local\Temp\nsfBF8E.tmp\utorrent.exe" /S /FORCEINSTALL 1110010101111110
component0.exe"C:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component0.exe" -ip:"dui=1c7487c6-fb64-489a-aab8-599765f1942d&dit=20240719163947&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&b=&se=true" -vp:"dui=1c7487c6-fb64-489a-aab8-599765f1942d&dit=20240719163947&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100&oip=26&ptl=7&dta=true" -dp:"dui=1c7487c6-fb64-489a-aab8-599765f1942d&dit=20240719163947&oc=ZB_RAV_Cross_Tri_NCB&p=707e&a=100" -i -v -d -se=true
saBSI.exe"C:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US

Show all 10 entries

OperaSetup.exe"C:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component2_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a
setup.exeC:\Users\<USER>\AppData\Local\Temp\7zS8D699A73\setup.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a --server-tracking-blob=NWM0ZDM5OTE2ZWNhYzVlYTk3NzJkOGY2MzcxNmMzNTEwYmFmMGExYjNkZWQ3NmMwNDY0ZGZhNmJkOWMxMGU4ZTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3MjExMjc2MTAuMDkyNiIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiNWUwNTUyZDYtOGY0YS00YzRhLWE0YmUtODkyZTk1Y2ZlYmVlIn0=
uTorrent.exe"C:\Users\<USER>\AppData\Roaming\uTorrent\uTorrent.exe"
setup.exeC:\Users\<USER>\AppData\Local\Temp\7zS8D699A73\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\<USER>\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.24 --initial-client-data=0x360,0x364,0x368,0x35c,0x36c,0x704eb1f4,0x704eb200,0x704eb20c

Network contacts

37 hosts, listed as 20 addresses, 19 links. Links show the host and path only.

IP address18.154.99.69
IP address54.230.17.224
IP address18.154.99.188
IP address65.8.243.49
IP address67.215.238.66
IP address18.238.136.2

Show all 39 entries

IP address52.4.65.159
IP address67.215.246.203
IP address52.41.24.247
IP address23.220.206.43
IP address107.167.125.189
IP address107.167.96.31
IP address69.164.32.2
IP address52.23.64.202
IP address52.0.127.199
IP address44.209.153.108
IP address69.164.33.2
IP address52.55.49.168
IP address44.212.156.241
IP address34.193.134.93
URLhttp://download-new.utorrent.com/endpoint/utorrent/os/riserollout/track/stable
URLhttp://i-6000.b-47132.ut.bench.utorrent.com/e
URLhttp://update.utorrent.com/installstats.php
URLhttp://i-21.b-47132.ut.bench.utorrent.com/e
URLhttp://apps.bittorrent.com/utorrent-onboarding/player.btapp
URLhttp://i-24.b-47132.ut.bench.utorrent.com/e
URLhttp://i-29.b-47132.ut.bench.utorrent.com/e
URLhttp://i-32.b-47132.ut.bench.utorrent.com/e
URLhttp://i-49.b-47132.ut.bench.utorrent.com/e
URLhttp://i-38.b-47132.ut.bench.utorrent.com/e
URLhttp://cdn.ap.bittorrent.com/control/tags/ut.json
URLhttp://cdn.ap.bittorrent.com/control/feature/tags/ut.json
URLhttp://i-64.b-47132.ut.bench.utorrent.com/e
URLhttp://i-62.b-47132.ut.bench.utorrent.com/e
URLhttp://i-43.b-47132.ut.bench.utorrent.com/e
URLhttp://update.utorrent.com/checkupdate.php
URLhttp://i-139.b-47132.ut.bench.utorrent.com/e
URLhttp://btinstall-artifacts.bittorrent.com/helper_ui/helper_web_ui.btinstall
URLhttp://utclient.utorrent.com/images/mobile-icon.png

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\is-AEI8K.tmp\software.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\_isetup\_setup64.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\Logo.png
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\license.rtf
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-H34LB.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\RAV_Cross.png

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-T5U9A.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\WebAdvisor.png
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-QA7NO.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\Opera_new.png
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-RLP5T.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\uTorrent.exe
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-PH6HT.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component0
WrittenC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\is-HG088.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component0
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component2
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component0.exe
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1.zip
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1_extract\installer.exe
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1_extract\saBSI.exe
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component1_extract
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component2.zip
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component2_extract\OperaSetup.exe
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\component2_extract
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\license.rtf
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\Logo.png
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\Opera_new.png
DeletedC:\Users\<USER>\AppData\Local\Temp\is-0GOCM.tmp\RAV_Cross.png

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

Auto-startrsSyncSvc
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\Version
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\InstallLocation
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\Contact
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\InstallDate

Show all 16 entries

DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\HelpLink
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\VersionMajor
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\ProductID
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\RegCompany
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\Comments
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\URLUpdateInfo
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\ModifyPath
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\HelpTelephone
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP\Language

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
\xb5Torrent/{1F44C754-37E7-2687-70D4-148E574DF026}
Global\SyncRootManager
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex

Show all 10 entries

cversions.3.m
Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Global\Opera/Installer/C:/Users/Bruno/AppData/Local/Programs/Opera
Global\OneSettingQueryMutex+compat+encapsulation

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processservices.exeC:\Windows\system32\services.exe
VM processDllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

9ec0549549e262a31456…3fa152Not checked
no saved verdict
e0c57df6c2f2fe12b7b9…fccccbNot checked
no saved verdict
fcd504990fe139151e1e…63e467Not checked
no saved verdict
94f19254d9f0b4d11bd9…03a088Not checked
no saved verdict
9b7e2ea77e518b50e5dd…8f1412Not checked
no saved verdict
ddd1c13d30e139f1d0c2…0c7c82Not checked
no saved verdict
71e47d0a10a7008ec767…80982cNot checked
no saved verdict
bc80a73499325898c086…2a2443Not checked
no saved verdict
d4c4e05fade7e76f4a2d…68e153Not checked
no saved verdict
e5c29d95e950013b8800…f03b82Not checked
no saved verdict

Chapter 04

Technical details

16 of the 72 antivirus engines that checked it flag it; signed by Rainberry Inc.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 76 enginesComplete16 of 72 engines flagged it · 4 gave no result DetailsDec 24, 2025

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsSep 7, 2026

Contacted hostsMalwareTips URL scannerPartial17 of 37 contacted hosts were cross-checked; coverage is incomplete DetailsSep 7, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete2 MalwareTips behaviour rules DetailsSep 7, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 7, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 7, 2026

Engines that flagged it 16

DrWeb (major engine)Adware.Downware.20091
ESET-NOD32 (major engine)Win32/OfferCore.E potentially unwanted application
Fortinet (major engine)Riskware/OfferCore
GData (major engine)Win32.Application.OfferCore.C
Microsoft (major engine)PUABundler:Win32/uTorrent_BundleInstaller
Sophos (major engine)OfferCore (PUA)
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1696973977de06d0

8 more in the full engine list

File fingerprint

Last analyzed: Sep 7, 2026, 12:07 PM UTC

SHA-256: 2c39da85232292347d60c0a0ac3ee372e5c6f1b47e25a2ca740a8339e6099115
SHA-1: 8e9dcce5178755c744ac7dd16131b0984f34f2be
MD5: 3afce6ffdddc0661da0acdae24de06d0

About this file

utorrent_installer 3.6.0.exe is a Win32 EXE file of 1.7 MB.

Type and size: Win32 EXE · 1.7 MB
Signer: Rainberry IncValid code signature.
First seen: Aug 30, 2023On VirusTotal.
Submitted by: 448 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Sep 7, 2026

Antivirus consensus

16 of 72 engines flagged this file

16 malicious0 suspicious56 not flagged4 no result

4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
6flagged
Tier-236 engines
8flagged
Low-trust18 engines
2flagged

View all 76 engine results

BkavMalicious: W32.AIDetectMalware
CAT-QuickHealMalicious: Trojan.Ghanarava.1696973977de06d0
CrowdStrikeMalicious: win/grayware_confidence_100% (W)
CTXMalicious: exe.adware.offercore
CylanceMalicious: Unsafe
DeepInstinctMalicious: MALICIOUS
DrWebMalicious: Adware.Downware.20091
ESET-NOD32Malicious: Win32/OfferCore.E potentially unwanted application
FortinetMalicious: Riskware/OfferCore
GDataMalicious: Win32.Application.OfferCore.C
GoogleMalicious: Detected
MalwarebytesMalicious: PUP.Optional.BundleInstaller
MicrosoftMalicious: PUABundler:Win32/uTorrent_BundleInstaller
PandaMalicious: PUP/BundleInstaller
SophosMalicious: OfferCore (PUA)
VaristMalicious: W32/ABApplication.IAYO-7230
AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BaiduClean
BitDefenderClean
BitDefenderFalxNo result
ClamAVClean
CMCClean
CynetClean
ElasticClean
EmsisoftClean
F-SecureClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MaxSecureClean
McAfeeDClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.

2 heuristics

MITRE ATT&CK profile

Persistence× 1Cred access× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

PersistenceScheduledTask
T1543.003 T1053.005
medium
The sandbox recorded persistence through a service or scheduled task. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.
Evidence
rsSyncSvc
CredentialDumper
T1003 T1003.001
low
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
Evidence
T1003 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy10 sections

.text

6.36

.itext

5.97

.data

5.05

.bss

0.00

.idata

5.03

.didata

2.75

.edata

1.88

.tls

0.00

.rdata

1.38

.rsrc

6.73

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

448

Hundreds of people have uploaded this — common.

Total submissions

505

Includes repeat uploads by the same source.

First seen

3y ago

Aug 30, 2023

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is utorrent_installer 3.6.0.exe safe, or is it malware?

utorrent_installer 3.6.0.exe is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. 16 of the 72 antivirus engines that checked it flag it, some as offercore. Don't install it unless you're sure where it came from. If you need the software, download a fresh installer from the developer's own website.

What is utorrent_installer 3.6.0.exe?

utorrent_installer 3.6.0.exe is a software installer, about 1.7 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Aug 30, 2023.

How many antivirus engines detected utorrent_installer 3.6.0.exe?

16 of the 72 antivirus engines that checked it flag utorrent_installer 3.6.0.exe, including Microsoft and ESET. We weigh which engines flagged it and what else the scan found, not just the count.

I already downloaded and installed utorrent_installer 3.6.0.exe — what should I do?

No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it. 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.

Is utorrent_installer 3.6.0.exe digitally signed?

Yes. utorrent_installer 3.6.0.exe has a valid digital signature from Rainberry Inc, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of utorrent_installer 3.6.0.exe?

The SHA-256 fingerprint of utorrent_installer 3.6.0.exe is 2c39da85232292347d60c0a0ac3ee372e5c6f1b47e25a2ca740a8339e6099115, and its MD5 is 3afce6ffdddc0661da0acdae24de06d0. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

How up to date is this analysis of utorrent_installer 3.6.0.exe?

This report reflects the scan on Sep 7, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is utorrent_installer 3.6.0.exe safe? Treat it as suspicious.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

Engines that flagged it 16

File fingerprint

About this file

16 of 72 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is utorrent_installer 3.6.0.exe safe? Treat it as suspicious.

What We Detected

Threat Behavior

What To Do Now

Test run summary

What the test run showed

Confirmed in the test run

Sandbox labels we could not confirm (common in safe files too)

What happened in the test

Input file

Processes

Files

Network

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Engines that flagged it 16

File fingerprint

About this file

Related file reports