cleanuploader | ChromeSetup_v1[.]3[.]87[.]370[.]exe

Resubmissions

03/10/2025, 07:22

251003-h7d9haak9v10

23/03/2024, 14:28

240323-rtatlabb8s10

13/02/2024, 16:52

240213-vdjy4sed478

Sharing

Copy URL Twitter E-mail

General

Target
ChromeSetup_v1.3.87.370.exe
Size 1.2MB
Sample240323-rtatlabb8s
SHA256 40678643ade16f4bb14659ab1918206f588ed8bb1d64a44b519b8c99a5bb80df
MD5 2b62dd154b431d8309002d5b4a35de07
SHA1 2216268cd5af2036f5904bb394caef475ea12e6e
SHA512 93d101ca706faef9a8967d229b2ff500909ea6a51e010e8b620f5cbc568188b172e25325ea7d0eccb62fa0584ae5d125daacc9588bb6a65aad69f0cde5ac0fe0
SSDEEP 24576:N5xO1W494JjgIt+3/7BtKK9lIFeu0NBXcajul+t5QiYnWXwkL3yrLzUCU5h5/:8W494JjgI0TBtK4lye5BsajuuOPsL3yE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader cleanuploader

Malware Config

Signatures

Cleanuploader family
cleanuploader

Detects CleanUpLoader 1 IoCs

Cleanuploader is a loader malware written in C++.

loader

resource	yara_rule
sample	mal_cleanuploader

File Explorer

ChromeSetup_v1.3.87.370.exe

.exe 1.2MB

ChromeSetup_v1.3.87.370.exe

IMPHASH d24bf1771fafb976ee4119c57365c6ac
SHA256 40678643ade16f4bb14659ab1918206f588ed8bb1d64a44b519b8c99a5bb80df
MD5 2b62dd154b431d8309002d5b4a35de07
SHA1 2216268cd5af2036f5904bb394caef475ea12e6e
SHA512 93d101ca706faef9a8967d229b2ff500909ea6a51e010e8b620f5cbc568188b172e25325ea7d0eccb62fa0584ae5d125daacc9588bb6a65aad69f0cde5ac0fe0
SSDEEP 24576:N5xO1W494JjgIt+3/7BtKK9lIFeu0NBXcajul+t5QiYnWXwkL3yrLzUCU5h5/:8W494JjgI0TBtK4lye5BsajuuOPsL3yE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects CleanUpLoader

Cleanuploader is a loader malware written in C++.

loader

PE Signature issue

Digest

9d:dc:9b:49:da:9e:1f:82:c1:95:3b:84:ed:f6:b5:31:02:67:ef:5a:a5:45:e8:19:b0:e2:9f:72:06:4e:a9:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91440515324832161Q,CN=Shantou Chenghai Rongsheng Arts Company Ltd.,O=Shantou Chenghai Rongsheng Arts Company Ltd.,L=Shantou,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c186a61736f6e77616e674078696f6e677374656e672e6e6574,1.3.6.1.4.1.311.60.2.1.1=#13075368616e746f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Feb 13, 2024

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

53:0c:9f:c0:5d:0b:9d:49:72:63:e8:f7

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 2, 2024 - Feb 2, 2025

Minor OS version

Major OS version

Entry point

34060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\admin\Desktop\Work\FileInstaller\Release\FileInstaller.pdb

user32

DialogBoxParamW PostQuitMessage UpdateWindow BeginPaint LoadCursorW GetMessageW DefWindowProcW DestroyWindow MessageBoxW CreateWindowExW EndDialog GetSystemMetrics RegisterClassExW LoadAcceleratorsW LoadStringW ShowWindow DispatchMessageW TranslateAcceleratorW TranslateMessage LoadIconW EndPaint

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey

kernel32

GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP CreateFileW FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile HeapSize WriteConsoleW IsValidCodePage GetCommandLineW CreateMutexW GetLastError CloseHandle GetSystemTime MultiByteToWideChar GetNativeSystemInfo SetFileAttributesA CreateDirectoryA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetEndOfFile WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc

ole32

CoInitializeEx CoCreateInstance CoUninitialize

shell32

ShellExecuteExA

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ChromeSetup_v1.3.87.370.exe

PE Signature issue

user32

advapi32

kernel32

ole32

shell32

generic