CliqzInstaller-de.exe

Classification: Malicious

CliqzInstaller-de.exe is a malicious file sample. Reported by 1 threat source, last seen 2019-03-26. Detected by 2 antivirus engines.

Detection summary

  • 2 antivirus detections (2% detection ratio)
  • 0 IDS alerts
  • 13 processes observed
  • 19 contacted hosts
  • 26 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Worm.Chir Hybrid-Analysis 2019-03-26 21:17:12 2019-03-26 21:17:12

Tags

ransomware

Sample information

Filenames
CliqzInstaller-de.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
340320 bytes
MD5
d2da3bc9cb6287073428c82049dc02f1
SHA-1
c28c0c500a2830989d92bce6e2396a7e1551d898
SHA-256
9263b5a5045dc22c4c754b35d85037002933d28ed14401c24b1486e5b80ddd9d
First indexed
2019-03-26 21:17:12
Last updated
2019-03-26 21:17:12

Antivirus detections

EngineDetection
ZillyaWorm.Chir.Win32.44135
CrowdStrikewin/malicious_confidence_60% (D)

Network contacts

99.84.254.2 99.84.240.62 99.84.240.216 99.84.240.130 52.71.43.36 99.84.240.166 204.237.142.121 52.18.148.152 35.160.78.190 99.84.254.15 52.28.68.107 35.169.154.237 151.101.0.201 52.5.14.69 99.84.254.122 172.217.17.138 216.58.192.195 34.231.182.39 35.157.228.183

DNS requests

a1089.dscd.akamai.net ambassador-production-v2-elb-506154624.eu-central-1.elb.amazonaws.com api.cliqz.com cdn.cliqz.com collector-hpn.cliqz.com collector.hpn.cliqz.com cs9.wac.phicdn.net d1zkz3k4cclnv6.cloudfront.net d3lzckbpcn57bz.cloudfront.net detectportal.firefox.com eff.map.fastly.net locprod1-elb-eu-west-1.prod.mozaws.net logging-vpc-new-1656974903.us-east-1.elb.amazonaws.com o.ss2.us ocsp.pki.goog ocsp.rootca1.amazontrust.com ocsp.rootg2.amazontrust.com ocsp.sca1b.amazontrust.com offers-api-production-lb-1981944578.eu-central-1.elb.amazonaws.com offers-api.cliqz.com reports.cliqz.com safe-browsing-quorum.privacy.cliqz.com safebrowsing.googleapis.com shavar.prod.mozaws.net stats.cliqz.com www.https-rulesets.org

Process list

NameCommand line
9263b5a5045dc22c4c754b35d85037002933d28ed14401c24b1486e5b80ddd9d.exe
setup-stub.exe.\setup-stub.exe
download.exe/LaunchedFromStub /INI=%TEMP%\nsmFC25.tmp\config.ini
setup.exe.\setup.exe /LaunchedFromStub /INI=%TEMP%\nsmFC25.tmp\config.ini
nsBB11.tmp"%PROGRAMFILES%\Cliqz\maintenanceservice_installer.exe"
maintenanceservice_installer.exe
maintenanceservice.exeinstall
cliqz.exe
cliqz.exe-contentproc --channel="4472.0.1594242029\1249919598" -parentBuildID 20190311160606 -greomni "%PROGRAMFILES%\Cliqz\omni.ja" -appomni "%PROGRAMFILES%\Cliqz\browser\omni.ja" -appdir "%PROGRAMFILES%\Cliqz\browser" - "%LOCALAPPDATA%\ow\Mozilla\Temp-{14edeaaf-5583-4048-b4c4-dd85e6469a2f}" 4472 "\\.\pipe\gecko-crash-server-pipe.4472" 1248 gpu
cliqz.exe-contentproc --channel="4472.6.743228212\839399761" -childID 1 -isForBrowser -prefsHandle 1508 -prefMapHandle 1800 -prefsLen 1 -prefMapSize 169257 -schedulerPrefs 0001,2 -parentBuildID 20190311160606 -greomni "%PROGRAMFILES%\Cliqz\omni.ja" -appomni "%PROGRAMFILES%\Cliqz\browser\omni.ja" -appdir "%PROGRAMFILES%\Cliqz\browser" - 4472 "\\.\pipe\gecko-crash-server-pipe.4472" 1892 tab
cliqz.exe-contentproc --channel="4472.13.845309369\181808154" -childID 2 -isForBrowser -prefsHandle 1312 -prefMapHandle 1276 -prefsLen 1466 -prefMapSize 169257 -schedulerPrefs 0001,2 -parentBuildID 20190311160606 -greomni "%PROGRAMFILES%\Cliqz\omni.ja" -appomni "%PROGRAMFILES%\Cliqz\browser\omni.ja" -appdir "%PROGRAMFILES%\Cliqz\browser" - 4472 "\\.\pipe\gecko-crash-server-pipe.4472" 2124 tab
cliqz.exe-contentproc --channel="4472.20.197778557\1850199532" -childID 3 -isForBrowser -prefsHandle 2316 -prefMapHandle 2320 -prefsLen 1466 -prefMapSize 169257 -schedulerPrefs 0001,2 -parentBuildID 20190311160606 -greomni "%PROGRAMFILES%\Cliqz\omni.ja" -appomni "%PROGRAMFILES%\Cliqz\browser\omni.ja" -appdir "%PROGRAMFILES%\Cliqz\browser" - 4472 "\\.\pipe\gecko-crash-server-pipe.4472" 2332 tab
cliqz.exe-contentproc --channel="4472.27.261835188\1918449628" -childID 4 -isForBrowser -prefsHandle 3020 -prefMapHandle 3024 -prefsLen 2491 -prefMapSize 169257 -schedulerPrefs 0001,2 -parentBuildID 20190311160606 -greomni "%PROGRAMFILES%\Cliqz\omni.ja" -appomni "%PROGRAMFILES%\Cliqz\browser\omni.ja" -appdir "%PROGRAMFILES%\Cliqz\browser" - 4472 "\\.\pipe\gecko-crash-server-pipe.4472" 2488 tab