Overview

overview

10

Static

static

3

2026-05-23...lc.exe

windows10-2004-x64

10

2026-05-23...lc.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc
  • Size 3.3MB
  • Sample260523-b136qaav6n
  • SHA256 6025ec3fa54fde63c8717264390124645c85953dceead06802c2880997adc236
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
chromelevatorexecutionhacktoolspywarestealer

Malware Config

Targets

    • Target
      2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc
    • Size 3.3MB
    • SHA256 6025ec3fa54fde63c8717264390124645c85953dceead06802c2880997adc236
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionchromelevatorhacktoolspywarestealer

    • Detects ChromElevator

    • Family: ChromElevator

      ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

      hacktoolchromelevator
    • Custom signature

      Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

    • Custom signature

      Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks