elysiumstealer

General

Target

Latest_protected.exe
Size

5.6MB
Sample

241201-qtft6sxkdk
MD5

6609fbd025ee98c12839bd46bc6a7d29
SHA1

53712a862ffdbf172cc93c203023c9feeb13e436
SHA256

0ecb9b2ccd461e33db5a31cb422c91acf6cffc1d65650f980288175c0f62e5e1
SHA512

8af86784156ca9b6fdcd530b4ef0d22b727ce6199f585947d0ddcd70a786bf58702268a5211440a39c84d745f6bf229476fc33e9364c6f9628d3e19b9c1cbfd2
SSDEEP

98304:Kw31I0VJIFNf9YDNSrk6MA+bHQkOGHezT8Bu9tiSD53I4kf9Yf6Iq7NRvUSeKQYR:11I0VJIF195rkPA++FDkfTIqp3An9c5

Score

10^/10

Malware Config

Targets

- Target
  
  Latest_protected.exe
- Size
  
  5.6MB
- MD5
  
  6609fbd025ee98c12839bd46bc6a7d29
- SHA1
  
  53712a862ffdbf172cc93c203023c9feeb13e436
- SHA256
  
  0ecb9b2ccd461e33db5a31cb422c91acf6cffc1d65650f980288175c0f62e5e1
- SHA512
  
  8af86784156ca9b6fdcd530b4ef0d22b727ce6199f585947d0ddcd70a786bf58702268a5211440a39c84d745f6bf229476fc33e9364c6f9628d3e19b9c1cbfd2
- SSDEEP
  
  98304:Kw31I0VJIFNf9YDNSrk6MA+bHQkOGHezT8Bu9tiSD53I4kf9Yf6Iq7NRvUSeKQYR:11I0VJIF195rkPA++FDkfTIqp3An9c5
Score

10^/10

elysiumstealer discovery evasion stealer themida trojan
- ElysiumStealer
  ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
  stealer elysiumstealer
- ElysiumStealer Support DLL
- Elysiumstealer family
  elysiumstealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3