CrocoRAT Hides in a Signed Fake Chrome Installer and Bundles Its Own Python

Oct 21, 2026 · Original article ↗

Summary

Analysis traces five CrocoRAT builds hidden in signed fake software installers. The malware can run commands, steal browser and wallet data, and phish credentials; researchers note the October stealer may not run because of an installer check.

Key points

The 27.8 MB ChromeInstaller.msi is validly signed but unrelated to Chrome; it installs Python and malicious scripts under C:\ProgramData\App\.
The installer runs a launcher as SYSTEM, which creates the AdvancedIPRun scheduled task to start the RAT loader at logon and every 15 minutes.
CrocoRAT can execute operator commands, transfer files, report the machine’s IP address, and update or shut down.
A fake Windows Security credential dialog targets domain-joined and Entra ID machines; entered credentials are checked against Windows and sent to the operator’s server.
On eligible non-company PCs, a stealer injects code into Chrome and Edge to collect saved passwords, cookies, payment-card details, browsing history, sign-in tokens, and wallet-extension information.
A second module searches for desktop crypto wallets and, if it finds one, scans files for recovery phrases before uploading collected data.
The October RAT is encrypted and requires a key from the operator’s server. Researchers warn the SYSTEM-level company-PC check may prevent the stealer from running, and they could not confirm delivery or attribute the activity.

Article Details

Attack Vectors: A malicious MSI impersonating a Chrome installer installs a private Python runtime and runs the CrocoRAT kit.
The installer runs its launcher as SYSTEM and creates the AdvancedIPRun scheduled task to start the RAT loader at logon and every 15 minutes.
The loader fetches Python add-ons from PyPI and requests a server-side key to decrypt and run the RAT in memory.
On domain-joined and Entra ID machines, the loader presents a genuine Windows credential dialog and sends verified credentials to the operator's server.
On non-company PCs without SentinelOne, the stealer injects a DLL into suspended Chrome and Edge processes to collect browser data.
The wallet module searches for desktop wallet files and, when it detects a wallet, scans documents for recovery phrases before uploading collected data in archive chunks.
Defensive Notes: Monitor for pythonw.exe running from C:\ProgramData\App\, C:\ProgramData\advanced-ip-scanner\app\, or C:\ProgramData\trservice\.
Look for the AdvancedIPRun scheduled task, particularly on systems that do not use Advanced IP Scanner.
Alert when Python starts chrome.exe or msedge.exe, or when Python outside developer tooling installs packages from PyPI.
Treat an unexpected credential prompt owned by pythonw.exe as an incident; reset any password entered into it.
Block the listed RAT key-server and stolen-data-upload IP addresses.
If found on a home PC, treat browser credentials, cookies, and wallet recovery phrases stored on the machine as compromised; change passwords from a clean device and move funds to a new wallet.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]56[.]84[.]221`	August RAT key server.
IPV4	`132[.]243[.]209[.]131`	RAT server used by the July builds.
IPV4	`23[.]26[.]156[.]59`	RAT server used by the July builds.
IPV4	`38[.]134[.]148[.]11`	October RAT key server and credential-drop destination.
IPV4	`41[.]216[.]182[.]164`	October stolen-data upload server.
IPV4	`64[.]177[.]43[.]123`	October stolen-data upload server.
SHA256	`1c05972a1ae4f8c4f46468637f1a80fe08784d60e112ff6740bad5f3a35817dc`	SHA-256 hash associated with runner.py in the malicious kit.
SHA256	`75108e48f55e715d105059acd81f9db1003b4ed39df5b929a9b5331c3e3b0a64`	SHA-256 hash associated with launcher.py in the malicious kit.
SHA256	`77e4df8122d4fd0bcb7e04623ed479d2c90841ccaa0c6ad9cfc342f9d622860d`	SHA-256 hash of the malicious MSIX build from 14 July.
SHA256	`7b2d729e6912e4374298cdf92ac5ae5e1160f12ad80e852dabd4f9db75cfbda5`	SHA-256 hash of the malicious MSIX build from 13 August.
SHA256	`8b167cb0fe53c839902bd8936ec384bb9fcfa7c8ae81299d3671394607d7c0b7`	SHA-256 hash of the malicious decryptor add-on.
SHA256	`907da6987c3fd2115fd62c8dbcba9837cbdeb8dd00851265c601a93261184343`	SHA-256 hash of a malicious MSIX build from 21 July.
SHA256	`98939c94abb5a8db0dcee4bd319b399f8410ebc837c935b9706751244fdf610c`	SHA-256 hash of another malicious MSIX build from 21 July.
SHA256	`9dd26653fdcbcf44889471c3d6f5e30b679abbc77f0cf93a78f88e1d3efbc8ee`	SHA-256 hash associated with run.py in the malicious kit.
SHA256	`d928b532f3244c0f9d2b459f39054f0c23850f795dac50a51d3b3a795aa79a0b`	SHA-256 hash of the browser-injection DLL used by the stealer.
SHA256	`de35dd440f4b55682b015290ce207b944b95ea8d4e2ff23023bcbd025c31d9a2`	SHA-256 hash of the October malicious ChromeInstaller.msi.