1. Home
  2. Software
  3. Chrommme

Chrommme

Chrommme is a backdoor tool, written using the Microsoft Foundation Class (MFC) framework, that has infrastructure overlaps with Gelsemium.[1]

ID: S0667
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 01 December 2021
Last Modified: 01 December 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1105 Ingress Tool Transfer

Chrommme can download its code from C2.[1]
Enterprise T1027 Obfuscated Files or Information

Chrommme can encrypt sections of its code to evade detection.[1]
Enterprise T1113 Screen Capture

Chrommme has the ability to capture screenshots.[1]
Enterprise T1082 System Information Discovery

Chrommme has the ability to list drives.[1]
Enterprise T1016 System Network Configuration Discovery

Chrommme can enumerate the IP address of a compromised host.[1]
Enterprise T1033 System Owner/User Discovery

Chrommme can retrieve the username from a targeted system.[1]
Enterprise T1497 .003 Virtualization/Sandbox Evasion: Time Based Evasion

Chrommme can set itself to sleep before requesting a new command from C2.[1]

References

  1. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.