elysiumstealer

General

Target

7937EA95FD4F9233C67604928AC12DC9.exe
Size

381KB
Sample

210423-sr1kk7ntee
MD5

7937ea95fd4f9233c67604928ac12dc9
SHA1

78ba827669310f3d41c304ecad5722f9dc67b534
SHA256

6b75eca8240542c8c796ce48498680535206b79d2f53087a99a82078a9bc21e1
SHA512

8508af2a354cd656a4c35f5372d5b7fcc463ae1a96b66076b34c3e2bdc82c0eb2f5e1e29793f6bc6ea26cd919e8488249b1a75f60ea34d46b3bb291ca44c8ce3

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

baskar

C2

zubelyev.xyz:80

Targets

- Target
  
  7937EA95FD4F9233C67604928AC12DC9.exe
- Size
  
  381KB
- MD5
  
  7937ea95fd4f9233c67604928ac12dc9
- SHA1
  
  78ba827669310f3d41c304ecad5722f9dc67b534
- SHA256
  
  6b75eca8240542c8c796ce48498680535206b79d2f53087a99a82078a9bc21e1
- SHA512
  
  8508af2a354cd656a4c35f5372d5b7fcc463ae1a96b66076b34c3e2bdc82c0eb2f5e1e29793f6bc6ea26cd919e8488249b1a75f60ea34d46b3bb291ca44c8ce3
Score

10^/10

elysiumstealer redline vidar baskar discovery evasion infostealer persistence spyware stealer upx vmprotect tofsee trojan
- ElysiumStealer
  ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
  stealer elysiumstealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2