2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307bSHA-256 hash

Reported by 1 independent source · first reported 19 Mar 2026 by Group-IB · last reported 19 Mar 2026

Last reported 7 months ago

What the reports say

1 report, newest first · the exact sentence from each

“Besides, we discovered a self-developed tool named “ChromeKB3.exe” (SHA256: 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b), described by the criminals as a “Chrome Appbound Injection – extract passwords from Chrome.”.”

Group-IBVendor19 Mar 2026
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods

Indicators reported together

named in the same reports

51b9f246d6da8563…e6a3a7baebd2in 1 report
3ab9575225e00a83…5fbe5c5c9235in 1 report
password-whamola[.]netin 1 report
194.87.31[.]69in 1 report
d65c293efb5e6d033c83b2ac472bf0cbin 1 report

Copy these 5 indicators · defanged

5 indicators, defanged, one per line

51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235
password-whamola[.]net
194.87.31[.]69
d65c293efb5e6d033c83b2ac472bf0cb

Also named with it: CVE-2024-55591, CVE-2024-37085, CVE-2023-27532, CVE-2025-32463

Thanks — we review every report.

Report a wrong value