Report - 2360d64197fa…93447cd5b8

No detections FILE

Quota 44

First seen: 2026-09-01T15:26:03Z
Last seen: 2026-10-08T10:01:59Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS18Connections in this report

ANALYSISNo detectionsAging

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: 2360d64197fab4a5082c4d5b330c642e5e423423a45150cb8d2a7893447cd5b8
SHA1: c1aed87c8a566bff88d88efe51a7ad5e9d80d87b
MD5: 95682e0fb2d60630d165c083e3c1ed87
Filename: 2360d641_mini_installer.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 137807952
Compile time: 2026-09-01T04:05:17Z
PE platform: x64 64-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context18 visible

Intelligence freshnessAging

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

3shown

caf62e18e80514389fc0bd395bf0783a48c1df0ec334f935228a4692776eb68a

0% tar 145111040 bytes contains

Filename caf62e18_gut42e1.tmp.bin File type tar MIME application/x-tar Size 145111040 SHA1 00555200e5e4fba0eb347c93ee0b552a6569f34a

ce66a5962fe6fa88521967e270a52065b8350595d74e70bc5048d1415b6473e1

0% tar 145111040 bytes contains

Filename ce66a596_gut35c1.tmp.bin File type tar MIME application/x-tar Size 145111040 SHA1 4802aee60c88307712170f1b607f00367692998c

703a60d0f9ff762aac71d90d37a729bc10820438795f8ddfa85286df8889552f

0% peexe 140956512 bytes drops

Filename 703a60d0_braveupdatesetup.exe.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 140956512 Compile time 2026-09-01T06:46:23Z

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

87217706da7605363931df15dc230547d667b1954e1ae48a85220be55f6933fe

0% lnk 2585 bytes drops

Filename 87217706_brave origin.lnk.bin File type lnk MIME application/x-ms-shortcut Size 2585 SHA1 62c9378173c87baa4f19dbe69df3665947b2b923

3cc428dcd9a5c9ee25a84857e7cdda832a481ece2d919146e1fa7b38d61530f9

0% bat 1477 bytes drops

Filename 3cc428dc_chromium_installer.log.bin File type bat MIME text/plain Size 1477 SHA1 476e38dd521a566c6ba965fdebee08061dfead96

2da9c2acaa3b583295beec9972754cd9f5c7737ba5857ccae66cddedc589a1c1

0% lnk 2587 bytes drops

Filename 2da9c2ac_brave origin.lnk.bin File type lnk MIME application/x-ms-shortcut Size 2587 SHA1 3aa2c8171ff58125a877cea19f214ce6f0e9be33

48dc8b9acbedb0b7de6579f89e873e9434ca389b8c6ed986f705c86fd2819599

0% sql 36864 bytes drops

Filename 48dc8b9a_cvj7gc84.exe.bin File type sql MIME application/x-msdos-program Size 36864 SHA1 806ed3a88d6c29b46b1a3916ad5b5d6a29f0eeeb

db9734c1e3001f7abd08bcc472a7b4f5daf8076eaee708f04ba98b11bd70131d

0% sql 45056 bytes drops

Filename db9734c1_qtieozzw.exe.bin File type sql MIME application/x-msdos-program Size 45056 SHA1 ceb64e84b9c5de7c1f450273f4f93abe40b4423b

Related IPs

Network IPs associated with this indicator.

5shown

44.236.15.141

0% US communicates

CIDR 44.224.0.0/11 Network 44.224.0.0-44.255.255.255 First seen 2026-06-19T22:05:51Z Last seen 2026-10-23T03:00:04Z

32.189.5.254

0% US communicates

CIDR 32.184.0.0/13 Network 32.184.0.0-32.207.255.255 First seen 2026-08-25T10:39:09Z Last seen 2026-10-23T03:00:04Z

184.32.79.112

0% US communicates

CIDR 184.32.0.0/12 Network 184.32.0.0-184.35.255.255 First seen 2025-10-17T22:16:55Z Last seen 2026-10-23T03:00:04Z

35.82.244.25

0% US communicates

CIDR 35.80.0.0/12 Network 35.80.0.0-35.95.255.255 First seen 2024-06-14T20:10:34Z Last seen 2026-10-03T09:04:59Z

44.252.158.227

0% US communicates

CIDR 44.224.0.0/11 Network 44.224.0.0-44.255.255.255 First seen 2025-07-12T09:18:34Z Last seen 2026-10-16T19:46:01Z

Related domains

Domains associated with this indicator.

5shown

variations.brave.com

0% .com communicates

Root brave.com TLD com Subdomain variations First seen 2023-10-01T10:31:38Z Last seen 2026-11-14T08:11:49Z

redirector.brave.com

0% .com communicates

Root brave.com TLD com Subdomain redirector First seen 2023-09-30T02:41:14Z Last seen 2026-11-14T00:34:26Z

go-updater.brave.com

0% .com communicates

Root brave.com TLD com Subdomain go-updater First seen 2018-01-25T17:33:23Z Last seen 2026-11-14T03:45:35Z

componentupdater.brave.com

0% .com communicates

Root brave.com TLD com Subdomain componentupdater First seen 2023-09-29T19:18:05Z Last seen 2026-11-14T08:11:48Z

brave-core-ext.s3.brave.com

0% .com communicates

Root brave.com TLD com Subdomain brave-core-ext.s3 First seen 2018-01-25T17:33:23Z Last seen 2026-11-14T08:11:48Z

Analysis details

64bitexefile-overlaywmi-activityadapter-discoverycryptopersistenceself-deletesigned

Freshness: Aging · Last seen 37 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 2360d64197fab4a5082c4d5b330c642e5e423423a45150cb8d2a7893447cd5b8
SHA1: c1aed87c8a566bff88d88efe51a7ad5e9d80d87b
MD5: 95682e0fb2d60630d165c083e3c1ed87
Filename: 2360d641_mini_installer.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 137807952
Compile time: 2026-09-01T04:05:17Z
PE platform: x64 64-bit
PE sections: 6
Import libraries: 3
TLSH: T13C683329021948E7D0E75AF9313D4A788B646C97D3FB9813896FD03A0BB37C53349A5B
SSDEEP: 3145728:64gjc5ExEWBklJ9FqH7dVoPp0qFXLZ1DNCtyrhrR4SAZ0DmL:Vgw5ExE0klHFU7kPtFJCQrhrafZ0U
Imphash: 865d1a9674197c47ebae84bb5c3fa76e
First seen: 2026-09-01T15:26:03Z
Last seen: 2026-10-08T10:01:59Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2018-01-25 to 2026-09-04. These are observation or metadata times, not execution order.

Infrastructure geography

5 infrastructure/location point(s) are visible on the map.

Intelligence freshness

Last seen 37 days ago. Revalidate volatile infrastructure before enforcement.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Aging

Last seen 37 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 2360d641_mini_installer.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 137807952
Compile time: 2026-09-01T04:05:17Z
PE platform: x64 64-bit
Entry point: 17008
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityadapter-discoverycryptopersistenceself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A file was accessed within the Public folder.
A process created a hidden window
Anomalous file deletion behavior detected (10+)
Attempted to write to a harddisk volume

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1548 — A file was accessed within the Public folder.
Tactics: TA0004 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1485 — Anomalous file deletion behavior detected (10+)
Tactics: TA0040
T1014 · T1542.003 — Attempted to write to a harddisk volume
Tactics: TA0003 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
F0013 — Bootkit
Objectives: OB0006 · OB0012
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Communication
Objectives: OC0006
Credential Access
Objectives: OB0005

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 443, 5353

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 443, 5353
Protocols: TCP, UDP

View details · 5 shown

IP: 99.86.101.68
Port: 443
Protocol: UDP

IP: 54.184.80.161
Port: 443
Protocol: TCP

IP: 44.252.158.227
Port: 443
Protocol: TCP

IP: 3.165.160.66
Port: 443
Protocol: TCP

IP: 224.0.0.251
Port: 5353
Protocol: UDP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: variations.brave.com
Type: A
Answers: 3.165.160.27, 3.165.160.66, 3.165.160.65, 3.165.160.120
Response: NOERROR

Query: redirector.brave.com
Type: A
Answers: 99.86.101.33, 99.86.101.40, 99.86.101.68, 99.86.101.82
Response: NOERROR

Query: go-updater.brave.com
Type: A
Answers: 44.252.158.227, 44.239.57.54, 44.237.22.49, 52.39.250.57, 52.37.131.56, 54.184.80.161, 54.214.153.210, 44.236.15.141
Response: NOERROR

Query: componentupdater.brave.com
Type: A
Answers: 100.21.26.152, 32.189.5.254, 184.32.79.112, 35.82.244.25
Response: NOERROR

Query: brave-core-ext.s3.brave.com
Type: A
Answers: 108.138.94.119, 108.138.94.89, 108.138.94.109, 108.138.94.15
Response: NOERROR

C2 candidates1

UDPports 5353

1 C2 candidate communications
0 domains, 1 IPs
Common ports: 5353
Protocols: UDP

View details · 1 shown

IP: 224.0.0.251
Port: 5353
Protocol: UDP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-09-01T04:05:17Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 17008
Sections: 6
Compile time: 2026-09-01T04:05:17Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 15286
Raw size: 15360
Permissions: rx
Entropy: 6.14

Name: .rdata
Virtual address: 20480
Virtual size: 5616
Raw size: 5632
Permissions: r
Entropy: 4.37

Name: .data
Virtual address: 28672
Virtual size: 176
Raw size: 512
Permissions: rw
Entropy: 0.28

Name: .pdata
Virtual address: 32768
Virtual size: 672
Raw size: 1024
Permissions: r
Entropy: 2.92

Name: .rsrc
Virtual address: 36864
Virtual size: 137773360
Raw size: 137773568
Permissions: r
Entropy: 8.0

5 shown

Imports3

3 DLL groups

3 import DLL groups
5+ imported functions summarized

View details · 3 shown

Library: ADVAPI32.dll
Functions: ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW …

Library: SHELL32.dll
Functions: CommandLineToArgvW

Library: KERNEL32.dll
Functions: CloseHandle, CreateDirectoryW, CreateFileW, CreateProcessW, DosDateTimeToFileTime, DuplicateHandle, EnumResourceNamesW, ExitProcess …

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, B7, BL, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: B7
Language: ENGLISH US

Type: BL
Language: ENGLISH US

Type: RT_ICON
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

Type: RT_VERSION
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: Brave Software, Inc.
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2024-05-28 – 2027-08-06

View details · 5 shown

Subject: Brave Software, Inc.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1716854400.0
Valid to: 1817596740.0
Fingerprint: F8AC5F11DE7E26383B7A389FC19A2613835799D7

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Valid from: 1659312000.0
Valid to: 1952035140.0
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert
Issuer: DigiCert Assured ID Root CA
Valid from: 1163116800.0
Valid to: 1952035200.0
Fingerprint: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check