MalwareBazaar Database
This page shows some basic information the YARA rule FakeTorrent_Loader_HashedAPI_Win64 including corresponding malware samples.
Database Entry
| YARA Rule: | FakeTorrent_Loader_HashedAPI_Win64 |
|---|---|
| Author: | PeterFellow |
| Description: | Stage-1 x64 loader from fake TV-episode torrents (LimeTorrents etc., Oct 2026; same campaign as Thereallo's South Park S29E03 analysis, C2 beenetprotect.com). Decoy USER32/GDI32/ole32 imports with no kernel32, a \SystemRoot\System32\ native path, and repeated FNV-1a prime multiplications (the article documents FNV-1a for the footer; its role in API resolution is unverified). Per that analysis the overlay carries a ChaCha20-encrypted stealer and a 64-byte footer, behind roughly 0.9-1 GB of padding. |
| Firstseen: | 2026-10-23 17:14:45 UTC |
| Lastseen: | 2026-10-23 17:15:27 UTC |
| Sightings: | 2 |
Malware Samples
The table below shows all malware samples that matching this particular YARA rule (max 1000).
| Firstseen (UTC) | SHA256 hash | Tags | Signature | Reporter |
|---|