hxxps://gateway.chrome-error[.]co/release.zipURL
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
It’s a trap: Detecting a cryptominer on a popular website using Group-IB MXDR“When the page is loaded, the script downloads the archive (in a non-displayed iframe) at the link hxxps://gateway.chrome-error[.]co/release.zip and renames the file payload.exe contained in it to chromium-patch-nightly.0.0.<3 random digits>.<4 random digits>.”
Indicators reported together
named in the same reports- 33251d1ec4f4ec19…4f0144259171in 1 report
- 87968d094b1722e6…f2828e667117in 1 report
- 6bc997af69c70233…f5f70fb411b5in 1 report
- chrome-error[.]coin 1 report
- d01b8765f1d2cf8d8722161b5ddfdc70in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUVmisdxiY543hTd2SHkuRqSwDArBBjvcwD3wNm5zeZVDin 1 report
- gateway.pinata[.]cloudin 1 report
- hxxps://gateway.chrome-error[.]co/probe/v1/%E2%80%99,%E2%80%99then%E2%80%99,%E2%80%996481640KcopPX%E2%80%99,%E2%80%99src%E2%80%99,%E2%80%994548eMqYQQ%E2%80%99,%E2%80%99location%E2%80%99,%E2%80%996rZKPYZ%E2%80%99,%E2%80%99getAttribute%E2%80%99,%E2%80%99__exoclick__ads__show%E2%80%99,%E2%80%99split%E2%80%99,%E2%80%991243065zgUVSa%E2%80%99,%E2%80%99173080bsKStH%E2%80%99,%E2%80%996QQsqtI%E2%80%99,%E2%80%991651400hjUOci%E2%80%99,%E2%80%99http%E2%80%99in 1 report
- gateway.chrome-error[.]coin 1 report
- hxxps://gateway.chrome-error[.]co/payload/v1%E2%80%99in 1 report
- hxxps://gateway.chrome-error[.]co/probe/v1/undefined/in 1 report
- hxxps://gateway.chrome-error[.]co/payload/v1in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmcMovkgsDLcDn7SM1ifWwWZyaCjpoH7bCepmsb882AvZjin 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUBgSVFmhT1GU1YuoqDY7ZX47TWsWJBN3pLgbQF4jRjRZ%E2%80%9Din 1 report
- c122eba0264bfd7e383f015cecf59fbdin 1 report
- c16860e7bf4f4a33…c8eb04453995in 1 report
- hxxps://gateway.pinata[.]cloud/ipfs/QmUBgSVFmhT1GU1YuoqDY7ZX47TWsWJBN3pLgbQF4jRjRZin 1 report
- hxxps://cdnjs.cloudflare[.]com/ajax/libs/jszip/3.10.1/jszip.min.js%E2%80%99in 1 report
- t[.]downloadin 1 report
- hxxps://gateway.chrome-error[.]co/release.zip%E2%80%99in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.