Overview
overview
8Static
static
3camfrog_6.1.146.exe
windows10-2004-x64
7camfrog_6.1.146.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...me.exe
windows10-2004-x64
7$PLUGINSDI...me.exe
windows11-ltsc_2024-x64
7$TEMP/goog...up.exe
windows10-2004-x64
3$TEMP/goog...up.exe
windows11-ltsc_2024-x64
3$PLUGINSDI...ar.exe
windows10-2004-x64
8$PLUGINSDI...ar.exe
windows11-ltsc_2024-x64
8$TEMP/Goog...ed.exe
windows10-2004-x64
8$TEMP/Goog...ed.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...rs.exe
windows10-2004-x64
3$PLUGINSDI...rs.exe
windows11-ltsc_2024-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...60.exe
windows10-2004-x64
3$PLUGINSDI...60.exe
windows11-ltsc_2024-x64
3$PLUGINSDIR/eula.html
windows10-2004-x64
3$PLUGINSDIR/eula.html
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ed.dll
windows10-2004-x64
3$PLUGINSDI...ed.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...og.dll
windows10-2004-x64
3$PLUGINSDI...og.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...y.html
windows10-2004-x64
3$PLUGINSDI...y.html
windows11-ltsc_2024-x64
3$PLUGINSDIR/w7tbp.dll
windows10-2004-x64
3$PLUGINSDIR/w7tbp.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
camfrog_6.1.146.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
camfrog_6.1.146.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Camfrog_Chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Camfrog_Chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$TEMP/googleupdatesetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$TEMP/googleupdatesetup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Camfrog_Toolbar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Camfrog_Toolbar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$TEMP/GoogleToolbarInstaller_stub_signed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$TEMP/GoogleToolbarInstaller_stub_signed.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/DownloadOffers.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/DownloadOffers.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/cfigm60.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/cfigm60.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/eula.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/eula.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/gcapi_dll.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/gcapi_dll.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/gtapi_signed.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/gtapi_signed.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/killfrog.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/killfrog.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/privacy.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/privacy.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/w7tbp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/w7tbp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target $PLUGINSDIR/Camfrog_Toolbar.exe
- Size 261KB
- Sample260905-sm3fpstyfw
- SHA256 30d3d2f8cbbed9305a4292342d32acd2537c437c52b592877ebfefa1e4adea23
- MD5 ce0a85f1a15af7490f40bdb729f0316e
- SHA1 206b975e495a049122409c4b5ddf250083226a47
- SHA512 427a679444359febff4e03acd871091892e4428648f07ccd63d974908103ec789e492f79c57fcf7602fca725cf389b81316348bc4aac90f15580f54b84ff1fd9
- SSDEEP 6144:cmt6MmlXt2svZLLIb/TbVPXe8DyF8dT6OVk17gJT6uWEeK:cmt6tlXt2+ZLkbBPefskNgJT6BK
- TLSH T180441244F7A19467EDF50F309171A766EFB9C912ECD0B28693644E1E3BBABD1A40C324
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 19 2504 googletoolbarinstaller_stub_signed.exe 25 2504 googletoolbarinstaller_stub_signed.exe - Executes dropped EXE 1 IoCs
pid Process 2504 googletoolbarinstaller_stub_signed.exe - Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp338A.tmp googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar.7.5.6710.2136.manifest.xml googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_32_09F85E3D9F025797.dll googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbar_64_DA7B2809524A7AD4.dll googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp9037.tmp googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_64_E36F178812AC18E6.dll googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp4FB7.tmp googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp36C9.tmp googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp8C8C.tmp googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmpEDFD.tmp googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarUser_32_52E818EF81C83A9B.exe googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp94AE.tmp googletoolbarinstaller_stub_signed.exe File opened for modification C:\Program Files (x86)\Google\Google Toolbar\Component\cmp9924.tmp googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_0948D9E6AD49F674.dll googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_75E7DC5B4867B140.dll googletoolbarinstaller_stub_signed.exe File created C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_D6EBD55792EF3063.exe googletoolbarinstaller_stub_signed.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Camfrog_Toolbar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language googletoolbarinstaller_stub_signed.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2504 1432 Camfrog_Toolbar.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Camfrog_Toolbar.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Camfrog_Toolbar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\googletoolbarinstaller_stub_signed.exegoogletoolbarinstaller_stub_signed.exe /o:0 /r:CFTB /e:asknot /d:ask /h:ask /q2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp36C9.tmp
- Size 189KB
- SHA256 28839a5dfc07a7a6c866ecf63ce02f5ce493d0ae4d130f4c8727383b27c8b157
- MD5 0c9482b13ca66d9f4a30bfbc730a35b8
- SHA1 8cff8935def4fa03882bb2f7d7477c5753783372
- SHA512 bfe418fd9f3d8ff9c46be47d44cc8ccf7f97a5c390d236b87590bf3bf079f7ac9e603b03ff16baa5bc6ef306c477c8800521758056941a5712e2461ae8946d05
- SSDEEP 3072:sYbJ6WFbAbpeoqheZSACx0LvQlZhpTBfIo0RtayUQLmd2GKto6:fblb8pj26WHTBYRt/E6
- TLSH T175148D1232E0C176F36F017D4925D61666FBB8208AB5C7473FD18E8B6E65A46CF25B03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp4FB7.tmp
- Size 302KB
- SHA256 3980ddc6d2f4ba674cd5e146a9936c9b78fe67d1f1cc63b93cf50e75869b773b
- MD5 e8b7fd67da14a7be57a5cb80e3139e60
- SHA1 8f5e0ebb2e39a13d2bb99ccdfbc712ce179f4242
- SHA512 3757b7d77ed25c53bfe7fe8cb5c9cf73f4d6a7cd180cdb1df89eeee9ead14e93c7a18b9e1a07a8d8770f8d92609f2ba90c6d16803cea710d3c812afb726f1978
- SSDEEP 6144:RzHSbomEo2rlEbS/iqAFqfgKlQwQQtBo184Tz/gg5BlMI9:RzHSbomEo2rlEBnqftlQwQQtBo184TUe
- TLSH T10364CF2274F1C4B3E45201758DD5872A86FAFC710C36894B6FD8294EAE73A81D72AF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp8C8C.tmp
- Size 250KB
- SHA256 3a494bd83d0b06f12cfb63b066a48562f9c03152eed7149ee97ff07a0e31395d
- MD5 638e3d612e5e2bbd4f77a3902a2c19e1
- SHA1 e377b94c661fec61716210be4c06f97a229260cb
- SHA512 f9ffa45c7e354074f4212cd44f5dc7348054ba73899644b54e9bf5547f84391a7c23fef770878331880c1e5ea4f278b6d73d387cac161128d043e95fdd81f57b
- SSDEEP 6144:B2HfCkOe4cYCvgJPN+uBrsiqfWKgArvTB8KRtOqZuK:kZOe/vigrJWXavT6KRzL
- TLSH T182444B4972B44CB5EDB7D23ACD838A4AD6F178518760C3CF0670479A4E277E16A3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp9037.tmp
- Size 2.9MB
- SHA256 37b27f119319fe09e24f5b123ca56884fae83af74ffffbadccafb07e7375cc15
- MD5 e9b10d8a1ac18f5f90af61ab87a9b863
- SHA1 8bc76179cc0f29186bf1a428e4a2e821dc70759e
- SHA512 631b114eba7efaaf81538289b88307129adef8cca40bf0a54645850d29118bbabd2667cb36faeeecb2c5bce07f3ac7c12703c1f83f105022ce902475e8693c3b
- SSDEEP 49152:VSItasM96MEoj9kOSHSgxJsOHhpchGGFZRtSIKnasTSO1gs07Y2TRPuxw:VPtj3oVZO8nKnJTS5jIw
- TLSH T1C7E59E133BD38079D1BB12B4DD24E314A6F9FEB10937CA5B2A54050FE92A987DA36713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp94AE.tmp
- Size 4.4MB
- SHA256 9612d1454d59fa4cec38f107ae81918cb20107561e1384fd43f082c251d45ad8
- MD5 63f928f8ea91cb1a248f1be52a6371af
- SHA1 b03ee8e61c8cf93e3545ec0e1293c9d2186abc50
- SHA512 44754aa4cf0ef2d09ac32a5c79c9183429987ac528e75526b0a15c20dc42014ccb57e420ce33ec7c364459ef6b5678c927a1e21dc13b3725d4eab455ad40ad20
- SSDEEP 49152:xynaf3/oqsklFqUQw1nTzmAodyrJFp8wdEybEoiwjNq0XtpYUEdoLRgYUS9RiyPA:7qUQBlJTonXt+WUS9Ri13SykIw0
- TLSH T19B264B4672F940A8D0BBD23ACE63CA4FD2F17A824A71C38F552087CA9F63771452E765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmp9924.tmp
- Size 996KB
- SHA256 e87e16302d9df36cd3661c00320ed3f4cfb5828fedad35b85352004c7c070afe
- MD5 91f67ae6f0c164fac8eb2b73dbd5fc88
- SHA1 fde01bc6081d750fb51ab847f4ee67ca7c3aec22
- SHA512 47c62f880c8e14706bfc4abb83cb3cf640f095182e41b4642162e52ff0ab7549372b77102db3534946cd60fe1a2ec08c8362cb321748cd4035d4fd1246ced05f
- SSDEEP 12288:vxV5iTAcbkQ7Mk01VFM6sHZim1VrkOQBjISASoiNWqvyw5G9taxUfebQzQHNq6B3:tFD1VF96kRWqvyiG9MQzQHB
- TLSH T1CD256B72B1A09916D1F73170E8BB1AE46D79AC93D921981A714CFD8B3FF1D40807BB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Google Toolbar\Component\cmpEDFD.tmp
- Size 1.1MB
- SHA256 bb8c5c08c0c276e75777e90d5569dcd0448e7f565488b4f2ecc48957c6c77b79
- MD5 71ff025c24ea6e0fc972427208b7af9d
- SHA1 3ad27e35cb65eff7afba194d5eb1f9e6ca02837a
- SHA512 aa9ba0c24b66b3b1fb5d96a90409f76938a3a612c0f8f77c7c6ed46307c58d962634bac64820162f2bbe6f4170eb3a2be2a125ea7bbd216de2ea2cd368135046
- SSDEEP 24576:D/sA+1wvTfmNeGHfOW+yt8ho86WpZ7TlFamJNVreeu:D/F+2vTOeGHfd+yt8ho8nzTlFamLVCeu
- TLSH T143354B123AF3813AF1B70A74ED74961056F5BE625A33C91B3E54324DCD76A828E25F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Google Toolbar\gtmE10.tmp
- Size 16KB
- SHA256 6334987095ba09d2868a22612bbe007574d089adc8b19632e297e8c577c81627
- MD5 ab91439b02d6387149770b7a332c3f5a
- SHA1 cdf2b3c9f1aad0563663b1740f3fd4f696d2e24d
- SHA512 bc8b68ac30d13643f6187423b39331bc01e3a804269cc35021bdaeef3f1bad1eae4f9933e0bf670ed980dad6fc491554b628a52de46296c986fe7e882984800c
- SSDEEP 192:vmZFr8NJ2MqaB0QW6VdR5aH/yeI86vHrBvGFV+Os8vdZYZ3:vmZR8NwMqaBBWGdR4HzYGlC
- TLSH T1E8723373A1FD5CA661310AA22F6C3C995F93A0D35DAB328CF59BF99007E7A04071B1B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GoogleToolbarInstaller_stub_signed.exe
- Size 229KB
- SHA256 ad68cfbbd2765be47b430cb0b3b527ade826e43c2ed6681ce6b9b5b44c8f18ff
- MD5 39d998e29dc9277c8762070901e69a32
- SHA1 ebd09f3ec33b4e56ebc3eccc0107689d4c5a2bca
- SHA512 cec7b2dad52ea5015c1a7b819fc1c3287325711b43dee50827f90b9f890dd4d34acacfa1fb65e3f0e62835dfaf0b1c93cde84274c78caf76e1cded8e327d7834
- SSDEEP 6144:M3wpq8sDsLLIb/TKVPXe8D0F8dT63VkiHFBGeWIY4AfJrrUZ:M3ssDsLkbiPenXkMNWIYzxrgZ
- TLSH T13F341264F6604715E9082FB85176E6DEDF319C4AAE9260D14132FD3E3EBA3747A08738
- MD5 SHA1 SHA512 SSDEEP TLSH