Overview

overview

10

Static

static

3

2026-03-13...ar.exe

windows10-2004-x64

10

2026-03-13...ar.exe

windows11-21h2-x64

6

Resubmissions

24/04/2026, 07:32

260424-jddasacw3k10

13/03/2026, 04:39

260313-e9199sht8t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar
  • Size 111KB
  • Sample260313-e9199sht8t
  • SHA256 4ae933ea4c0a65ea088fe1a715f8b23eabedf8f2bb0b7d22c0e967234ad696e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
chromelevatordiscoveryexecutionhacktoolspywarestealer

Malware Config

Targets

    • Target
      2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar
    • Size 111KB
    • SHA256 4ae933ea4c0a65ea088fe1a715f8b23eabedf8f2bb0b7d22c0e967234ad696e4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionchromelevatorhacktoolspywarestealer

    • ChromElevator

      ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

      hacktoolchromelevator

    • Chromelevator family

      chromelevator

    • Detects ChromElevator

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks