File verdict·Decided by the MT AI Engine
Our call

Safe

Official qBittorrent 5.0.5 x64 installer: clean across 71 engines, high prevalence, confirmed clean by community researchers.

Trust score92High trust
MT AI confidence · 95%
qbittorrent_5.0.5_x64_setup.exe
38.1 MB
875c13a389eac2c656e40f75ec7f
Antivirus engines
0 of 76 flagged
Code signing
Unsigned
Age
First seen 1y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

95%Confidence
Very high
Reasoning

Zero malicious detections from high-coverage scanning, including full tier-1 consensus on clean, strongly indicates safety. High prevalence as common_old commodity software aligns with legitimate distribution of qBittorrent, a well-known open-source application. Community comments unanimously confirm it as the official installer. While heuristics flag process injection (likely NSIS unpacking into Explorer) and generic YARA rules, these lack backing from engines or sandbox verdicts and are outweighed by clean signals. No malicious behavior in drops, contacts, or runtime.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 0/71 malicious (17/17 tier1 clean)

  2. prevalence: common_old (3661 uniqueSources)

  3. communityComments: 'official setup of qbittorrent 5.0.5 x64'

  4. fileName: qbittorrent_5.0.5_x64_setup.exe (hasInstallerHint=true)

Points in its favour
  • engines: 0 malicious / 17 tier1 clean
  • prevalence: common_old (3661 sources)
  • communityComments: 4x clean/qBittorrent confirmations
  • file.reputation=7, ageDays=392
Points against
  • triggeredHeuristics: MalwareTips.Synth.ProcessInjection (high severity)
  • externalIntel.yaraify: 2 rules ('win_rat_generic')
  • behaviour.offensiveTechniques: T1055, T1134
  • tags: detect-debug-environment, overlay
What to do

This is a legitimate qBittorrent installer. Proceed with installation confidently, preferably from the official website to ensure the latest version.

Threat family attribution

Sus Obf Enc Spoof Hide PE corroborated by 1 source

  • 2 YARA rules
    Sus_Obf_Enc_Spoof_Hide_PE, win_rat_generic
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
22

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1027T1036T1055T1059T1071T1082T1083T1112T1115T1125T1129T1134T1222T1485T1497T1497.001T1529T1547.009T1548T1574.002
Spawned processes
15
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
"C:\Users\<USER>\Desktop\qbittorrent_5.0.5_x64_setup.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
"C:\Program Files\qBittorrent\qbittorrent.exe"
$(unnamed)
%SAMPLEPATH%\qbittorrent_5.0.5_x64_setup.exe
$(unnamed)
C:\Windows\System32\UI0Detect.exe
$(unnamed)
C:\Program Files\Google3596_1686482413\bin\updater.exe
$(unnamed)
%SAMPLEPATH%\875c13a389eac2c656c26ec2c676168b91acf5ba376bea4c31e2efe40f75ec7f.exe
+7 more processes captured.
Network activity
20
IP addresses20
  • 224.0.0.251
  • 20.75.60.91
  • 23.196.145.221
  • 23.53.122.199
  • 20.99.133.109
  • 184.27.218.92
  • 20.69.140.28
  • 192.168.0.14
  • 192.168.0.23
  • 23.32.75.18
+10 more
Filesystem & mutexes
33
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\nsvD5A0.tmp
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\UAC.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\LangDLL.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\System.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\modern-header.bmp
+10 more
Files deleted15
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\FindProcDLL.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\LangDLL.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\modern-header.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\modern-wizard.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsaD5C0.tmp\nsDialogs.dll
+10 more
Mutexes created3
  • cversions.3.m
  • Local\SessionImmersiveColorMutex
  • QtLockedFile mutex c:/users/bruno/appdata/roaming/qbittorrent/lockfile
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 314243a55c32679ad47350c1a7Never scanned
    never seen before
  • 005b0aa0c9a5b930dfddbea13dNever scanned
    never seen before
  • 51b8ff55b37dc5907d63a786e0Never scanned
    never seen before
  • 7808ed542a7833c4bd94687300Never scanned
    never seen before
  • bb86a4094dec468cb638a1389dNever scanned
    never seen before
  • c44e0313a9414cc0e49092034fNever scanned
    never seen before
  • ec31a26cdf3b41bca0d0645be0Never scanned
    never seen before
  • f78e59b5bdd586181a992253d2Never scanned
    never seen before
  • 7d1e5ca3310b54d104c1b25c22Never scanned
    never seen before
  • 3da6605668f9178d11a89c224bNever scanned
    never seen before
External threat intelligence

1 corroborating signal from researcher-curated sources

YARAify HIT·2 community rules matchedView on YARAify
  • Sus_Obf_Enc_Spoof_Hide_PEby XiAnzheng
    Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
  • win_rat_genericby Reedus0
    Rule for detecting generic RAT malware
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 YARAify2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
YARAify (community)
Researcher-authored rules via abuse.ch
  • Sus_Obf_Enc_Spoof_Hide_PE
  • win_rat_generic
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjectionhigh

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\Explorer.EXE
  • DirectIpC2medium

    Sample contacted 15 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    20.75.60.91 · 23.196.145.221 · 23.53.122.199
Antivirus engine breakdown

0 detections across 76 engines

0 malicious0 suspicious76 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust21 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 76 engines report this file as clean.
Hash 875c13a389ea… cross-referenced against 76 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy5 sections
.text
6.44
.rdata
5.10
.data
4.13
.ndata
0.00
.rsrc
4.79
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
3,661
Hundreds of people have uploaded this — common.
Total submissions
8,369
Includes repeat uploads by the same source.
First seen by VT
1y ago
Apr 13, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/13/2025, 5:03:48 PM
First seen (MalwareBazaar)
Last analysis (VT)
2/18/2026, 7:55:35 AM
Scanned here
5/11/2026, 4:07:14 AM
File name
qbittorrent_5.0.5_x64_setup.exe
Size
38.09 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
875c13a389eac2c656c26ec2c676168b91acf5ba376bea4c31e2efe40f75ec7f
MD5
0ecf83f09c19df0f3c2806c4cc2b22a6
SHA-1
8d3cffae35513a22d37c17407d13abf1771d26bf
PE imphash
9dda1a1d1f8a1d13ae0297b47046b26e
First seen (VT)
4/13/2025, 5:03:48 PM
Last analysis (VT)
2/18/2026, 7:55:35 AM
First scan (MalwareTips)
5/11/2026, 4:07:14 AM
Last scan (MalwareTips)
5/11/2026, 4:07:14 AM
Community reputation
+7trusted
Behavior tags
peexedetect-debug-environmentoverlay
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
icotonevStaff
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.