Dropped-file hash links outer installer to an executed inner installer
A file written as `update.exe` matches a separately analysed installer, and the outer file’s process tree shows that copy running beneath it. Matching temporary executable content strengthens the nested-installer finding, but a mining-pool lookup recorded for the outer file cannot be assigned to a component.
An executable running as setup.exe wrote update.exe into a Downloads directory and appeared as its parent in a sandbox process tree. The important detail was not the update-themed filename: the written file’s SHA-256 matched a second executable that had been analysed independently as an installer. Was this merely a bundle of similarly named files, or could the records show how one installer operated inside another? CTX Threat Intelligence’s records support the latter.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read