ChocoShell Propose Change

Actor(s): APT29

According to Microsoft Threat Intelligence, ChocoShell is a PowerShell-based information stealer delivered and executed entirely in memory, with the primary objective of harvesting browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials from compromised systems. It was authored with developer comments suggesting AI-assisted code generation and performs defense evasion by disabling AMSI via .NET reflection and exiting silently when virtual machine or sandbox conditions are detected. To enable its most impactful capabilities it implements several ordered silent UAC bypass techniques with fallback to a visible prompt, and impersonates a SYSTEM process token to access browser encryption keys, while also using the Chrome DevTools Protocol to extract plaintext cookies and collecting cloud tokens and Wi-Fi profiles. Collected data is aggregated into a JSON structure, GZip-compressed and Base64-encoded, then exfiltrated over an encrypted HTTPS channel to the actor's C2 server before the script cleans up artifacts and removes its temporary elevation registry keys.

References

There is no Yara-Signature yet.