Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
69 IOCs
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Threat Actors
Malware Families
Excerpt
Elastic Security Labs has tracked REF9334, a Brazilian banking malware operation, since May 2025. Its toolkit is called KREMLIN (as named by the malware author, Kr3mlin4rt1st ), though nothing about the operation is Russian. Lures impersonate twelve Brazilian banks; error messages and code comments are written in Portuguese, and the operators' Ethereum transactions cluster during São Paulo working hours. Over 15 months and seven campaigns, they built a malicious browser…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →69 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | cheapzone.space | Low | Score 37/100 | First seen |
| URL | https://codecvideowin.online/f9e95a1e1fa3f3aebfc802c6c8e6a2eb | High | Score 58/100 | First seen |
| URL | https://codecvideowin.online/af15d5f?p=991589b0-4cc9-11f0-b9f4-1402ec3d56f0 | High | Score 58/100 | First seen |
| URL | https://volmira.site/api/ext?p=98d8049e-804f-11f1-b79f-ae3a8bb85d01 | High | Score 58/100 | First seen |
| Domain | find-postman.ddesdokww.workers.dev | High | Score 58/100 | First seen |
| URL | https://zaviro.online//api/v1/fingerprint | High | Score 58/100 | First seen |
| Domain | harialurdes.site | High | Score 58/100 | First seen |
| URL | https://codecaudiog.site/generate?domain=codecvideowin.online&payload=991589b0-4cc9-11f0-b9f4-1402ec3d56f0&prefix=NF&prefix_count=10&output=base64 | High | Score 58/100 | First seen |
| IP | 104.219.250.37 | High | Score 76/100 | First seen |
| URL | https://granderevolucao.store/5c92d3b8734b4f498752f735a1ca0987/ | High | Score 58/100 | First seen |
| URL | https://orange-sun-195a.checkeligibitily.workers.dev | Low | Score 31/100 | First seen |
| IP | 45.90.13.210 | Medium | Score 44/100 | First seen |
| SHA256 | ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f | High | Score 85/100 | First seen |
| URL | https://volmira.site/api/ext/version | High | Score 58/100 | First seen |
| SHA256 | 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 | Medium | Score 53/100 | First seen |
| IP | 178.92.162.38 | High | Score 86/100 | First seen |
| Domain | donalurdesconfeitos.site | High | Score 58/100 | First seen |
| Domain | marialurdes.site | High | Score 58/100 | First seen |
| IP | 104.21.69.130 | High | Score 58/100 | First seen |
| IP | 188.114.96.0 | Low | Score 43/100 | First seen |
| IP | 72.251.7.22 | Medium | Score 42/100 | First seen |
| IP | 172.67.208.181 | High | Score 58/100 | First seen |
| Domain | affordableonline.online | Low | Score 39/100 | First seen |
| IP | 216.203.21.40 | High | Score 58/100 | First seen |
| URL | https://cremeb.com/kremlin?p=########-####-####-####-############&prefix=NF&prefix_count=10&output=base64 | High | Score 58/100 | First seen |
| Domain | connection.timesmaluku.com | High | Score 58/100 | First seen |
| Domain | lojinhadoluiz.online | High | Score 58/100 | First seen |
| SHA256 | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 | Medium | Score 53/100 | First seen |
| Domain | mysterylink.xyz | Low | Score 37/100 | First seen |
| URL | http://www.creamp1eonlyfans.net | High | Score 58/100 | First seen |
| URL | https://acrobat-updater.com/api/v2/acrobat/latest | High | Score 58/100 | First seen |
| MD5 | 5f109e7bb3df4dea81946f2f853da288 | Medium | Score 53/100 | First seen |
| SHA256 | 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c | Medium | Score 53/100 | First seen |
| IP | 2.59.170.20 | High | Score 77/100 | First seen |
| IP | 172.67.200.134 | High | Score 58/100 | First seen |
| IP | 188.114.97.0 | Low | Score 41/100 | First seen |
| URL | https://graph.checkeligibitily.workers.dev/x01aab878f25420380b3?op=98d8049e-804f-11f1-b79f-ae3a8bb85d01 | High | Score 58/100 | First seen |
| IP | 37.16.74.34 | Low | Score 38/100 | First seen |
| MD5 | 87b76a60ba7c474dbf8f689df2808e1a | Medium | Score 53/100 | First seen |
| IP | 88.99.149.241 | High | Score 58/100 | First seen |
| IP | 188.114.97.1 | High | Score 71/100 | First seen |
| URL | https://connection.upgradeonline.site | High | Score 58/100 | First seen |
| IP | 209.99.185.204 | High | Score 58/100 | First seen |
| Domain | quirkyclub.club | Low | Score 37/100 | First seen |
| Domain | californicationdetroit.com | High | Score 58/100 | First seen |
| IP | 172.234.24.211 | Low | Score 36/100 | First seen |
| MD5 | 5c92d3b8734b4f498752f735a1ca0987 | Medium | Score 53/100 | First seen |
| URL | https://codecaudiog.site/87b76a60ba7c474dbf8f689df2808e1a?payload=f1d7b074-b81f-11ef-a763-1402ec3d56f0 | High | Score 58/100 | First seen |
| IP | 104.21.68.250 | High | Score 58/100 | First seen |
| Domain | luizestrelhashapr.online | High | Score 58/100 | First seen |
| IP | 172.239.57.117 | Low | Score 38/100 | First seen |
| IP | 37.16.74.100 | Medium | Score 57/100 | First seen |
| IP | 185.221.23.133 | Low | Score 33/100 | First seen |
| SHA256 | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 | High | Score 80/100 | First seen |
| Domain | version.checkeligibitily.workers.dev | High | Score 58/100 | First seen |
| IP | 72.251.7.23 | High | Score 58/100 | First seen |
| IP | 144.172.112.239 | High | Score 58/100 | First seen |
| Domain | lojinhadaana.org | High | Score 58/100 | First seen |
| SHA256 | 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 | Medium | Score 53/100 | First seen |
| URL | https://acrobat-updater.com/generate | High | Score 58/100 | First seen |
| IP | 176.98.187.47 | High | Score 58/100 | First seen |
| SHA256 | cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 | Medium | Score 53/100 | First seen |
| SHA256 | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca | Medium | Score 53/100 | First seen |
| MD5 | f9e95a1e1fa3f3aebfc802c6c8e6a2eb | Medium | Score 53/100 | First seen |
| IP | 104.21.2.131 | High | Score 58/100 | First seen |
| IP | 188.114.96.1 | Medium | Score 65/100 | First seen |
| URL | https://volmira.site//api/savecreds | High | Score 58/100 | First seen |
| IP | 45.90.13.77 | High | Score 58/100 | First seen |
| Domain | seguranca.versionnova.site | Medium | Score 41/100 | First seen |
IOC Relationship Graph
Building graph…