elysiumstealer

General

Target

B644F30DACDD7066907FD2807DB5FB0D.exe
Size

42KB
Sample

210523-haqe6a4bvx
MD5

b644f30dacdd7066907fd2807db5fb0d
SHA1

fdf07cd26db17172165cd928437dcc44921c038e
SHA256

8e4f30afa8d0ce48c46a39e2754d8f7adad90ae8ccaf0132b354be76076b20cc
SHA512

232a4219aacbc793df84691008b7b1ea1642a479048d0897c361a7fe7bfb597c14cdb31f4ef086e471f8c71d1a153269f8869fce5ddd8a7d68393ee3a027d73a

Score

10^/10

Malware Config

Targets

- Target
  
  B644F30DACDD7066907FD2807DB5FB0D.exe
- Size
  
  42KB
- MD5
  
  b644f30dacdd7066907fd2807db5fb0d
- SHA1
  
  fdf07cd26db17172165cd928437dcc44921c038e
- SHA256
  
  8e4f30afa8d0ce48c46a39e2754d8f7adad90ae8ccaf0132b354be76076b20cc
- SHA512
  
  232a4219aacbc793df84691008b7b1ea1642a479048d0897c361a7fe7bfb597c14cdb31f4ef086e471f8c71d1a153269f8869fce5ddd8a7d68393ee3a027d73a
Score

10^/10

elysiumstealer vidar discovery evasion persistence spyware stealer vmprotect plugx redline infostealer trojan
- ElysiumStealer
  ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
  stealer elysiumstealer
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2