Overview

overview

10

Static

static

10

2026-10-07...om.exe

windows10-2004-x64

7

Resubmissions

27/10/2026, 09:05

261027-k2f71scy4l10

08/10/2026, 04:13

261008-es4n3aaw9v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-07_d833ddb9e586748994916b5683660165_cobalt-strike_icedid_luca-stealer_njrat_satacom
  • Size 1.4MB
  • Sample261027-k2f71scy4l
  • SHA256 f33125200dc9b919579473b0e9cf61390e357319b4fc99dc91f577bdebdca2b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hacktoolchromelevator

Malware Config

Extracted

Family

  • chromelevator

C2

  • http://157.230.224.101:443

  • http://157.230.224.101:8080

  • http://157.230.224.101:8000

  • http://174.138.33.139:443

  • http://174.138.33.139:8080

  • http://174.138.33.139:8000

Attributes
  • auth_token

    3a6fad2ddf402cb0983bf4f75118bf9235b8c91d

Signatures

  • Family: ChromElevator

    ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

    hacktoolchromelevator
  • Detects ChromElevator v2 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-10-07_d833ddb9e586748994916b5683660165_cobalt-strike_icedid_luca-stealer_njrat_satacom
    .exe 1.4MB

2026-10-07_d833ddb9e586748994916b5683660165_cobalt-strike_icedid_luca-stealer_njrat_satacom

  • IMPHASH b1ca45e098639b37bdc03f5e762e6893
  • SHA256 f33125200dc9b919579473b0e9cf61390e357319b4fc99dc91f577bdebdca2b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx64arch:x64

  • Detects ChromElevator v2

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
1285440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths