Malicious
Unsigned ZIP posing as Chrome setup flagged as Win64 trojan by 5 tier-1 engines with family consensus and YARA evasion rules.
87c8bdb0e3dbddd586…276454ee01The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This new, unsigned ZIP file mimics a Chrome installer but triggers strong signals from tier-1 engines agreeing on 'win64' family. Kaspersky's EtwTamper detection points to event tracing evasion, common in trojans. Yaraify's 7 rule hits reinforce malware-like static features despite some generic nature. Lack of signing, zero reputation, and rare prevalence outweigh clean reports from other engines. No runtime data exists, but detection consensus drives the malicious call.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus: family='win64', agreeingEngines=3, strong=true
Yaraify rules: 'pe_detect_tls_callbacks', 'DebuggerCheck__API', 'golang_bin_JCorn_CSC846'
ESET-NOD32: 'Win64/Agent.DML.gen trojan' (tier1), Kaspersky: 'UDS:Trojan.Win32.EtwTamper.ajb' (tier1)
unsigned, no signerStats.found, prevalence 'rare_new' (1 submitter)
- No malicious contacted hosts
- No dropped children detected
- 12 tier-1 engines clean (possible FP hedge)
- 5 tier-1 malicious detections
- Tier-1 consensus on 'win64' family
- Yaraify 7 rule matches (evasion traits)
- Unsigned with no publisher history
- Rare new file (1 submission, 0 days old)
- Fake Chrome installer filename
Quarantine and delete this file immediately. Run a full system scan and avoid executing untrusted installers.
misc corroborated by 2 sources
- 7 YARA rulesDebuggerCheck__API, golang_bin_JCorn_CSC846, mht_inside_word
- VT (75 engines)misc
1 corroborating signal from researcher-curated sources
- DebuggerCheck__API
- golang_bin_JCorn_CSC846by Justin CornwellCSC-846 Golang detection ruleset
- mht_inside_wordby dPhishDetect embedded mht files inside microsfot word.
- pe_detect_tls_callbacks
- RIPEMD160_Constantsby phoul (@phoul)Look for RIPEMD-160 constants
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- DebuggerCheck__API
- golang_bin_JCorn_CSC846
- mht_inside_word
- pe_detect_tls_callbacks
- RIPEMD160_Constants
15 detections across 75 engines
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- x64-Chrome_Setup-886301.zip
- Size
- 17.66 MB
- MIME type
- application/x-zip-compressed
- Detected type
- ZIP
- SHA-256
- 87c8bdb0e3dbddd58680a5e97fd15600884a3d344cac212a96229e276454ee01
- MD5
- dc04e47a448abad08acbefa7fce1a6aa
- SHA-1
- dfa45e510fa41a5cd9058c67cc44b59ef96a6d5e
- First seen (VT)
- 4/30/2026, 3:09:52 AM
- Last analysis (VT)
- 4/30/2026, 3:09:52 AM
- First scan (MalwareTips)
- 4/30/2026, 3:10:50 AM
- Last scan (MalwareTips)
- 4/30/2026, 3:10:49 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.