» uTorrent.exe
Overview
Analysis
File Details
Behaviors (14)
Programs (1)
Downloads (962)

uTorrent.exe

µTorrent

BitTorrent Inc

µTorrent is a free ad-supported lightweight BitTorrent client. This is a setup program which is used to install the application. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘uTorrent’. This is the uninstaller utility registered in the Windows Control Panel for the program ?Torrent by BitTorrent Inc.. This executable runs as a local area network (LAN) Internet proxy server listening on port 8080. The file has been seen being downloaded from filehippo.com and multiple other hosts.

File name:

uTorrent.exe

Publisher:

BitTorrent Inc. (signed by BitTorrent Inc)

Product:

µTorrent

Version:

3.4.5.41865

MD5:

89144ed117c1d506ae3ab6d0e12f4d4b

SHA-1:

c1b83954974e8bdd58f4aecba2d8cf49787b8e9c

SHA-256:

771d8761ea4106f554dc99506a82da76ebbd9037bdf29ca702491fa6adc8d91c

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/23/2024 2:06:03 AM UTC (today)

File size:

2 MB (2,094,080 bytes)

Product version:

3.4.5.41865

Original file name:

uTorrent.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\utorrent.exe

Digital Signature

Signed by:

BitTorrent Inc

Authority:

Symantec Corporation

Valid from:

1/22/2016 1:00:00 AM

Valid to:

9/4/2016 1:59:59 AM

Subject:

CN=BitTorrent Inc, O=BitTorrent Inc, L=San Francisco, S=California, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

59123D60D39E60127D6B456A62C9DEAC

File PE Metadata

Compilation timestamp:

2/23/2016 2:18:51 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

12.0

CTPH (ssdeep):

49152:NNFRocoovsqEdi2tnC6HJwNe9sJ5GANyRRCXUd:/FRdKe2tnC4J0e9U55CRCK

Entry address:

0x4D7DD0

Entry point:

60, BE, 00, B0, 6F, 00, 8D, BE, 00, 60, D0, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 97, 5B, 4D, 00, 57, 83, C3, 04, 53, 68, CC, CD, 1D, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A... 
[+]

Code size:

1.9 MB (1,957,888 bytes)

Local Proxy Server

Proxy for:

Internet Settings

Local host address:

http://127.0.0.1:8080/

Local host port:

8080

Default credentials:

Program Uninstaller

Program name:

?Torrent

Display publisher:

BitTorrent Inc.

Display version:

3.4.5.41865

Uninstall string:

"C:\users\{user}\appdata\roaming\utorrent\utorrent.exe" \uninstall

2 Scheduled Tasks

Task name:

{80FC3E20-182D-4B8E-B5FA-19437869D26C}

Trigger:

Registration (Runs on registration)

Task name:

torrent

3 Startup Files (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

uTorrent

Command:

"C:\users\{user}\appdata\roaming\utorrent\utorrent.exe" \minimized

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

utorent

Command:

C:\users\{user}\appdata\roaming\utorrent\utorrent.exe \minimized

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

New startup

Command:

"C:\users\{user}\appdata\roaming\utorrent\utorrent.exe"

Startup File (User Run Once)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Name:

Application Restart #1

Command:

C:\users\{user}\appdata\roaming\utorrent\utorrent.exe

448 Windows Firewall Allowed Programs

Name:

C:\Documents and Settings\hussain\Application Data\uTorrent\uTorrent.exe

Name:

C:\Documents and Settings\admin\Application Data\uTorrent\uTorrent.exe

Name:

C:\Documents and Settings\GGG\Application Data\uTorrent\uTorrent.exe

Name:

C:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe

Name:

C:\Documents and Settings\maaz\Application Data\uTorrent\uTorrent.exe

Name:

C:\Documents and Settings\IRFAN\Application Data\uTorrent\uTorrent.exe

The file uTorrent.exe has been discovered within the following program.

BeyondTrust PowerBroker Desktops Client for Windows by BeyondTrust Software, Inc.

www.beyondtrust.com

About 9% of users remove it

The file uTorrent.exe has been seen being distributed by the following 50 URLs.