Chrome Browser Update.exe

Classification: Malicious

Chrome Browser Update.exe is a trojan (Windows executable, 1.2 MB). Detected by 77 antivirus engines. Linked to Lucifer malware.

Detection summary

  • 77 antivirus detections
  • 2 IDS alerts
  • 6 processes observed
  • 2 contacted hosts
  • 2 DNS requests

MITRE ATT&CK associations

Malware families: LUCIFER (S0532)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-12-13 16:15:03 2026-08-17 15:45:05 malicious-activity
Lucifer MalwareBazaar Abuse.ch 2024-12-13 16:01:21 2024-12-13 16:01:21 malicious-activity S0532 Lucifer

Tags

malicious windows-server-utility evasive infostealer

Sample information

Filenames
1b242c3226a5109e972f7cc2c64385f8f1fe128c67ebaa2f676dff4a18ba2dda, Chrome Browser Update.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
1270784 bytes
MD5
f3bf7d6b65e792931e13f61c6617e233
SHA-1
37485d960a2d54c3747fccbcb9e49f144ff9ac36
SHA-256
1b242c3226a5109e972f7cc2c64385f8f1fe128c67ebaa2f676dff4a18ba2dda
First indexed
2024-12-13 16:02:01
Last updated
2026-08-22 00:21:47

Antivirus detections

EngineDetection
ALYacGen:Variant.Ser.Jalapeno.103
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AlibabaTrojanSpy:MSIL/AgentTesla.b43f703d
ArcabitTrojan.Ser.Jalapeno.103
AvastWin32:PWSX-gen [Trj]
AviraHEUR/AGEN.1365276
BitDefenderGen:Variant.Ser.Jalapeno.103
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.Ghanarava.173658039517e233
CTXexe.trojan.msil
ClamAVWin.Packed.Pwsx-10039638-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebBackDoor.AgentTeslaNET.37
ESET-NOD32a variant of MSIL/Kryptik.AMUP
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Ser.Jalapeno.103 (B)
F-SecureHeuristic.HEUR/AGEN.1365276
FireEyeGeneric.mg.f3bf7d6b65e79293
FortinetMSIL/Remcos.GWMJE!tr
GDataGen:Variant.Ser.Jalapeno.103
GoogleDetected
IkarusTrojan.MSIL.Inject
K7AntiVirusTrojan ( 005be5131 )
K7GWTrojan ( 005be5131 )
KasperskyHEUR:Trojan-Spy.MSIL.Noon.gen
KingsoftMSIL.Trojan-Spy.Noon.gen
LionicTrojan.Win32.AgentTesla.l!c
MalwarebytesTrojan.MalPack.PNG
MaxSecureTrojan.Malware.315925373.susgen
McAfeeAgentTesla!F3BF7D6B65E7
McAfeeDti!1B242C3226A5
MicroWorld-eScanGen:Variant.Ser.Jalapeno.103
MicrosoftTrojan:MSIL/AgentTesla.RVKA!MTB
NANO-AntivirusTrojan.Win32.Noon.kuazlh
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingMalware.Obfus/[email protected] (RDM.MSIL2:EVwtnxcPMhu7TQjwsCA2/g)
SangforSpyware.Msil.AgentTesla.Vstu
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.tc
SophosTroj/Krypt-AMG
SymantecScr.Malcode!gdn34
TencentTrojan.Msil.Kryptik.cdd
Trapminesuspicious.low.ml.score
VIPREGen:Variant.Ser.Jalapeno.103
VaristW32/MSIL_Kryptik.KUK.gen!Eldorado
ViRobotTrojan.Win.Z.Ser.1270784
VirITTrojan.Win32.MSIL_Heur.A
WebrootW32.Trojan.Gen
ZillyaTrojan.Kryptik.Win32.4981875
alibabacloudTrojan[spy]:MSIL/AgentTesla.RYJO3DGW
huorongTrojan/MSIL.Agent.un
AVGWin32:MalwareX-gen [Pws]
AhnLab-V3Trojan/Win.Bladabindi.R589573
Antiy-AVLTrojan[Spy]/MSIL.Noon
AvastWin32:MalwareX-gen [Pws]
AviraTR/W32.MalwareX
BkavW32.Malware.B8E14D4F
DrWebTrojan.Packed2.50433
ESET-NOD32MSIL/Kryptik.AMUP trojan
F-SecureTrojan.TR/W32.MalwareX
FortinetMSIL/Formbook.GWMJE!tr
K7AntiVirusTrojan ( 005d5f371 )
K7GWTrojan ( 005d5f371 )
MalwarebytesTrojan.MalPack
McAfeeDTrojan:Win/GenericPack.BMP
RisingMalware.Obfus/[email protected] (RDM.MSIL2:EVwtnxcPMhu7TQjwsCA2/g)
SangforTrojan.Win32.Save.a
SkyhighAgentTesla!F3BF7D6B65E7
SophosTroj/Krypt-AQM
TrellixENSAgentTesla!F3BF7D6B65E7
VBA32TScope.Trojan.MSIL
VaristW32/MSIL_Agent.KBN.gen!Eldorado
ZoneAlarmTroj/Krypt-AQM

Network contacts

208.95.112.1 190.90.160.172

DNS requests

ip-api.com gomotest.premiumprotectiondis.org

Process list

NameCommand line
ChromeBrowserUpdate.exe
powershell.exeAdd-MpPreference -ExclusionPath "C:\ChromeBrowserUpdate.exe"
powershell.exeAdd-MpPreference -ExclusionPath "%APPDATA%\gcTcgzuHVAXxwZ.exe"
schtasks.exe/Create /TN "Updates\gcTcgzuHVAXxwZ" /XML "%TEMP%\tmp7629.tmp"
ChromeBrowserUpdate.exe
Zip.exe