Abe Office Malware Injects Into Chrome To Decrypt App-Bound Cookies
Original title: New Abe Office Malware Tricks Chrome Into Decrypting Its Own Protected Browser Cookies
The RAT uses browser injection to bypass Chrome's App-Bound Encryption for cookie decryption.
A remote-access trojan named AbeAgent.exe masquerades as an office helper. It installs with persistence, uses three add-ons including one to request decryption from Chrome's elevation service for App-Bound cookies. The stealer targets passwords and cookies from multiple browsers. Operators can interact with the victim's browser sessions via hidden desktop access.
Unconfirmed: Delivery method and full infection chain unknown; relationship between loaders unconfirmed.
- Signed by Kimberley Hankinson with SSL.com cert
- Uses default password AbeOffice-ChangeMe for encryption
- Targets Chrome, Edge, Brave, Opera, Firefox
- C2: 2.26.230[.]54:9090
- No observed stealer execution in sandbox
Impact: credential and session access from compromised browsers
- 1.Investigate AbeOffice directories
- 2.Revoke browser sessions
- 3.Reset credentials
- Products
- Chrome
- Malware
- AbeOffice RAT
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.26.230.54 | ad deployment. The primary command-and-control endpoint was 2.26.230[.]54:9090 . A second server, 87.199.195[.]141 , hosted a match |
| ipv4 | 87.199.195.141 | -control endpoint was 2.26.230[.]54:9090 . A second server, 87.199.195[.]141 , hosted a matching download page. VirusTotal association |
| sha256 | 3cec97aadc8e0da11e89a4aa454829292599b6b852afa620bb0aa811e9662d71 | 207b64ff225b7b35c7ff277 AbeCapability.dll (main RAT) SHA256 3cec97aadc8e0da11e89a4aa454829292599b6b852afa620bb0aa811e9662d71 AbeHvcn.dll (hidden desktop) SHA256 681293cbcf1436de6d8ae4c |
| sha256 | 681293cbcf1436de6d8ae4c358a1e76677593155fe393055376aa535809b5ffd | 2afa620bb0aa811e9662d71 AbeHvcn.dll (hidden desktop) SHA256 681293cbcf1436de6d8ae4c358a1e76677593155fe393055376aa535809b5ffd AbeBrowserShim.dll (signed) Note: IP addresses and domains |
| sha256 | 977f5a0124c4484772517336019d8f9a03d27abf9207b64ff225b7b35c7ff277 | fd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9 AbeAgent.exe SHA256 977f5a0124c4484772517336019d8f9a03d27abf9207b64ff225b7b35c7ff277 AbeCapability.dll (main RAT) SHA256 3cec97aadc8e0da11e89a4a |
| sha256 | eda3e8e4e87ccb0423886ae5cfd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9 | rustworthy. Indicators of compromise Type Value Note SHA256 eda3e8e4e87ccb0423886ae5cfd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9 AbeAgent.exe SHA256 977f5a0124c4484772517336019d8f9a03d27ab |
From the original article
3 min read at gbhackers.com
A newly analyzed remote-access trojan masquerading as an “Abe Office workstation helper” combines hidden-browser control with tooling designed to bypass Chrome’s App-Bound Encryption. Rather than breaking the cryptography, its browser stealer injects a helper into Chrome and requests decryption from inside the trusted browser process.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.