Malicious .crx file download

Over the past week we’ve seen a new TTP in our environment. There is a phish/download link that will download a .crx that contains a .zip that auto executes when the .crx file is opened.

The .zip mounts a .iso and executes a encrypted .bat.

The malware shares signatures of Qbot.

The interesting part is the file is downloaded from a Microsoft server and the c2 is behind a google api call out.

I’ll add more details later as I’m …

download malicious malware