KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

The KREMLIN malware operation infects computers with a malicious browser extension.

Here are the indicators of compromise (IoCs): Type Indicator Description SHA-256 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 PowerShell extension-installer implementation Domain connection[.]upgradeonline[. ]site Loader beaconing and extension-delivery infrastructure Domain www[.]creamp1eonlyfans[. ]net Network canary domain checked by KREMLIN Domain granderevolucao[.

]store Installer payload-hosting domain Domain volmira[. ]site Extension hosting and credential-exfiltration infrastructure Domain zaviro[. ]online Exfiltration and fingerprinting infrastructure Domain graph[.]checkeligibitily[.]workers[. ]dev Extension endpoint resolver Domain luizestrelhashapr[.

]online Resolved WebSocket command-and-control host Domain seguranca[.]versionnova[. ]site Infrastructure associated with a related KREMLIN branch Domain codecaudiog[. ]site Earlier KREMLIN campaign staging domain Domain codecvideowin[. ]online Earlier campaign extension-hosting domain Domain acrobat-updater[.

]com Earlier campaign lure and payload-hosting domain Domain lojinhadoluiz[. ]online FrameSync campaign extension infrastructure Domain orange-sun-195a[.]checkeligibitily[.]workers[. ]dev FrameSync campaign C2 resolver Domain cremeb[. ]com QR-extension and earlier KREMLIN campaign infrastructure Domain donalurdesconfeitos[.

]site Earlier extension-delivery infrastructure Domain marialurdes[. ]site Intermediate KREMLIN campaign domain Domain harialurdes[. ]site Intermediate KREMLIN campaign domain IP address 178.92.162[. ]38:443 REMCOS RAT command-and-control endpoint IP address 185.221.23[.

]133:4782 Earlier PULSAR RAT command-and-control endpoint IP address 185.221.23[. ]133:443 Earlier PULSAR RAT command-and-control endpoint IP address 144.172.112[. ]239:4782 Acrobat campaign PULSAR RAT endpoint IP address 45.90.13[. ]210:443 Acrobat campaign PULSAR RAT endpoint IP address 37.16.74[.

]100:443 Cremeb campaign PULSAR RAT endpoint IP address 37.16.74[. ]34:443 Cremeb campaign PULSAR RAT endpoint Ethereum smart contract 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b Active KREMLIN configuration dead-drop resolver Chrome extension ID ndpbidppejfanjbhfgjlohfanbfbklff AVSync malicious extension ID Chrome extension ID djodclnjknbpambeaaapadmdfhmbpeog FrameSync malicious extension ID Chrome extension ID cdgcjghdeinagopbaobhmaefigoafaaa QR-themed malicious extension ID File name SentinelMemoryScanner.exe Signed binary abused for DLL side-loading File name SentinelAgentCore.dll Unsigned KREMLIN payload masquerading as a legitimate DLL File name MicrosoftNodeRuntimeUpdater Scheduled-task name used for persistence File name output_image_202505.jpg Earlier Internet Archive-hosted RunPE module File name hotelmoskva.jpg JPEG carrier used to conceal a .NET injector File name...