chromelevator | 8945d42056ea3d26ca77d57613ee67e3980d158f23c25724db98e790fcda693a

General

Target
2026-11-02_8dfae86444d6d43f149f29426c61b8b2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 13.5MB
Sample261103-frpdessv4q
SHA256 8945d42056ea3d26ca77d57613ee67e3980d158f23c25724db98e790fcda693a
MD5 8dfae86444d6d43f149f29426c61b8b2
SHA1 0d7fbf7a7fe20bd3c13400c4b7238c3000603500
SHA512 777a8ecc2e33d88060f56462330800706c2628de648d8d855939b495ccc5a28c881b625fcaa6032cd5367926f4eb67697346e3da51a7207eb8e976a2fd5f54ce
SSDEEP 98304:smRsYgWgdSBmq+KnOGXwM78emJvmoHpP5Eq9fitQwq0Lb1h+Cah+4m3V9E8:/6hSBmBuljoP5EAUQJ2k8
TLSH
T151E66A67E8A505E8C0ADC1358A769513BFB13C8A8B3163D35B50FA246F73BD0ADB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-02_8dfae86444d6d43f149f29426c61b8b2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 13.5MB
- SHA256 8945d42056ea3d26ca77d57613ee67e3980d158f23c25724db98e790fcda693a
- MD5 8dfae86444d6d43f149f29426c61b8b2
- SHA1 0d7fbf7a7fe20bd3c13400c4b7238c3000603500
- SHA512 777a8ecc2e33d88060f56462330800706c2628de648d8d855939b495ccc5a28c881b625fcaa6032cd5367926f4eb67697346e3da51a7207eb8e976a2fd5f54ce
- SSDEEP 98304:smRsYgWgdSBmq+KnOGXwM78emJvmoHpP5Eq9fitQwq0Lb1h+Cah+4m3V9E8:/6hSBmBuljoP5EAUQJ2k8
- TLSH
  T151E66A67E8A505E8C0ADC1358A769513BFB13C8A8B3163D35B50FA246F73BD0ADB9704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery chromelevator hacktool persistence privilege_escalation spyware stealer
- Detects ChromElevator
- Family: ChromElevator
  ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
  hacktool chromelevator
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1