Full Report
Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and
Analysis Summary
# Tool/Technique: KREMLIN
## Overview
KREMLIN is a sophisticated Brazilian banking malware toolkit and ecosystem discovered by Elastic Security Labs (tracked as **REF9334**). Its primary objective is to compromise Chromium-based browsers (Chrome and Edge) to steal banking credentials, session tokens, and sensitive financial data. It is notable for its use of blockchain technology for C2 resilience and its ability to bypass modern browser integrity mechanisms.
## Technical Details
- **Type:** Malware Family / Banking Trojan / Browser Extension
- **Platform:** Windows (Targeting Google Chrome and Microsoft Edge browsers)
- **Capabilities:** Credential theft, session token hijacking, sandbox evasion, DLL side-loading, and blockchain-based C2 resolving.
- **First Seen:** May 2025
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment] (Masquerades as invoices/banking documents)
- **[TA0002 - Execution]**
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1176 - Browser Extensions]
- **[TA0005 - Defense Evasion]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks]
- [T1564.007 - Hide Artifacts: VPC/Blockchain] (Dead drop resolvers via Ethereum)
- **[TA0006 - Credential Access]**
- [T1185 - Browser Session Hijacking]
- [T1555.003 - Credentials from Web Browsers]
## Functionality
### Core Capabilities
- **Multi-stage Loading:** Utilizes JavaScript loaders to initiate the infection chain, performing environment checks before proceeding.
- **Blockchain C2 Resolving:** Uses Ethereum smart contracts as "dead drop resolvers" to store and update C2 and payload URLs, preventing takedowns by traditional domain blacklisting.
- **Credential & Token Theft:** Specifically targets browser profiles to exfiltrate active session tokens and login data for approximately 12 Brazilian financial institutions.
### Advanced Features
- **Integrity Bypass (Phantom Extension/GhostChrome-X):** Manipulates `Secure Preferences` and regenerates HMACs/App-Bound encrypted hashes to install malicious extensions without triggering browser warnings.
- **DLL Side-Loading:** Exploits a legitimate SentinelOne binary (`SentinelMemoryScanner.exe`) to load a malicious payload (`SentinelAgentCore.dll`).
- **Environmental Awareness:** Checks for minimum hardware specifications (at least 2 CPUs, >3GB RAM) and blacklisted analysis processes before execution.
## Indicators of Compromise
- **File Names:**
- `SentinelMemoryScanner.exe` (Legitimate binary used for side-loading)
- `SentinelAgentCore.dll` (Malicious payload)
- `AVSync System Inc.` (Extension name)
- **Extension ID:** `ndpbidppejfanjbhfgjlohfanbfbklff`
- **Network Indicators:**
- `0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b` (Ethereum Smart Contract)
- `volmira[.]site`
- `zaviro[.]online`
- `luizestrelhashapr[.]online`
- **Behavioral Indicators:**
- Modifications to Chrome `Secure Preferences` files.
- Creation of scheduled tasks for persistence.
- Process termination if debugging/VM tools are detected.
## Associated Threat Actors
- **REF9334** (Elastic Security Labs moniker)
## Detection Methods
- **Signature-based detection:** Monitor for the specific extension ID `ndpbidppejfanjbhfgjlohfanbfbklff` in browser directories.
- **Behavioral detection:** Monitor for unauthorized modifications to browser preference files and the execution of `SentinelMemoryScanner.exe` from unexpected or temporary directories.
- **Network monitoring:** Audit outbound traffic to known Ethereum gateway services or the specific identified C2 domains.
## Mitigation Strategies
- **Browser Hardening:** Implement policies to restrict the installation of extensions to a predefined "Allow List."
- **Endpoint Protection:** Use EDR solutions to monitor for DLL side-loading and suspicious scheduled task creation.
- **User Training:** Educate users on the risks of opening unsolicited JavaScript (.js) files disguised as documents.
- **Process Integrity:** Block the execution of known vulnerable binaries (like older versions of SentinelOne scanners) if not required for business operations.
## Related Tools/Techniques
- **GemStone:** A browser extension used by APT31 employing similar integrity bypass techniques.
- **BlueMoon Exploit Kit:** Used in campaigns sharing similar methodologies.
- **Dead Drop Resolvers:** Technique used by various high-level actors to maintain C2 resilience.