da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b

Sharing

Copy URL Twitter E-mail

General

Target
da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b
Size 25.5MB
Sample261113-graqpsz16p
SHA256 da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b
MD5 c2a38075b2cd935c874a508bcdaa18a4
SHA1 c02f72f073ada0699ff293a7364b63b5cfc9b067
SHA512 4ed3e6b472b805593b83db04fbe796364d677a17c2624f091a8a80e6308fcf82ebd41f4699f948b11bbe2f86b55b519a610f36b50a74a477da903a88657a3e4f
SSDEEP 393216:kjp944E3MpNssAecUH9Lw/lKSXDVRHYxoZWiDJIuL:GNeM4LeLH9s/wSTVoo0qL
TLSH
T1F4479F51B70B14F6FB434C3245F9BB3FBE35E2DC8974C829E964683AB661C1B859C290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner defense_evasion

Malware Config

Signatures

Fake Chrome/Google updater delivering miners 1 IoCs

miner defense_evasion

resource	yara_rule
sample	fake_chrome_update

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b

File Explorer

da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b

.exe 25.5MB

da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b

IMPHASH 3790baba98be8e176b23f93df3589dce
SHA256 da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b
MD5 c2a38075b2cd935c874a508bcdaa18a4
SHA1 c02f72f073ada0699ff293a7364b63b5cfc9b067
SHA512 4ed3e6b472b805593b83db04fbe796364d677a17c2624f091a8a80e6308fcf82ebd41f4699f948b11bbe2f86b55b519a610f36b50a74a477da903a88657a3e4f
SSDEEP 393216:kjp944E3MpNssAecUH9Lw/lKSXDVRHYxoZWiDJIuL:GNeM4LeLH9s/wSTVoo0qL
TLSH
T1F4479F51B70B14F6FB434C3245F9BB3FBE35E2DC8974C829E964683AB661C1B859C290
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Fake Chrome/Google updater delivering miners

miner defense_evasion
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:c2:d2:9f:d3:fd:4a:80:31:5b:f6:06:97:13:84:7e:4c:8d:c7:0b:19:cb:b4:26:2e:07:13:8f:74:7a:dd:85

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Google LLC

Chains

Nov 6, 2026

CN=Google LLC

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

shell32

SHGetSpecialFolderPathW SHGetStockIconInfo ShellExecuteExW

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateRemoteThread CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FileTimeToSystemTime FindResourceA FlushInstructionCache FreeLibrary GetACP GetCPInfo GetCommandLineW GetComputerNameExW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentVariableW GetExitCodeThread GetFileAttributesW GetFileSize GetFileType GetLargePageMinimum GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetProcessVersion GetProcessWorkingSetSize GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTimePreciseAsFileTime GetSystemTimes GetSystemWindowsDirectoryW GetTempPathW GetThreadContext GetTickCount GetTickCount64 GetTimeFormatW GetVersionExW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeConditionVariable InitializeCriticalSection InitializeSRWLock IsDebuggerPresent IsValidCodePage K32EnumProcessModulesEx LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource MoveFileExW MultiByteToWideChar OpenMutexW OpenProcess ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency ReadFile RemoveDirectoryW RemoveVectoredExceptionHandler SetConsoleCtrlHandler SetConsoleTitleW SetEvent SetFileTime SetUnhandledExceptionFilter SizeofResource Sleep SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TlsGetValue TryAcquireSRWLockExclusive VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WriteFile WriteProcessMemory lstrcatW lstrcpynW

api-ms-win-core-synch-l1-2-0

WaitForSingleObjectEx

api-ms-win-core-winrt-l1-1-0

WindowsCreateString WindowsDeleteString

shlwapi

PathCanonicalizeW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsDirectoryW PathIsRelativeW PathIsRootW PathStripToRootW PathUnquoteSpacesW SHLoadIndirectString StrCmpNW StrCmpW StrStrIW StrStrW

dbghelp

SymGetOptions

user32

ClientToScreen FindWindowW GetActiveWindow GetAsyncKeyState GetCapture GetCaretBlinkTime GetCaretPos GetClientRect GetDC GetDesktopWindow GetFocus GetForegroundWindow GetKeyState GetKeyboardState GetKeyboardType GetLastActivePopup GetMouseMovePointsEx GetShellWindow GetSysColorBrush GetSystemMetrics GetTopWindow GetWindowDC IsWindow IsWindowVisible LoadCursorW MapWindowPoints ReleaseDC ScreenToClient SystemParametersInfoW WindowFromPoint

winmm

auxGetNumDevs midiOutGetNumDevs timeGetTime waveOutGetNumDevs

ntdll

NtYieldExecution

secur32

EnumerateSecurityPackagesW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize

gdi32

CreatePen EnumFontsA EnumFontsW GetCharWidth32W GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW

msvcrt

fwprintf __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _wcmdln _wcsicmp _wcsnicmp abort atexit calloc exit fflush fprintf fputwc free localeconv malloc memcmp memcpy memset rand realloc setvbuf signal srand strerror strlen strncmp vfprintf wcscat_s wcscmp wcslen wcsncat_s wcsncmp wcsrchr wcsstr

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateContext CertDeleteCertificateFromStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertOpenStore CryptBinaryToStringA CryptQueryObject

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock

advapi32

ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW CryptAcquireContextW DeleteService GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

da39b6c34ade067a7632b1b9c18e517dcfff802a3162b2ac74da16614192655b

PE Signature issue

shell32

kernel32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

shlwapi

dbghelp

user32

winmm

ntdll

secur32

oleaut32

ole32

gdi32

msvcrt

crypt32

bcrypt

wtsapi32

userenv

advapi32

winhttp

generic