Overview

overview

10

Static

static

7

KayZer.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KayZer.exe

  • Size

    6.0MB

  • Sample

    241231-rs7ryaxjdp

  • MD5

    7988a817d0491d1cd117c2557a984697

  • SHA1

    d8d5581e2480ea04a7840bc787981ab52a7e81ae

  • SHA256

    3689a3d591ab4d7a7861ba1445aba8707da08011e01d34828858ffecbe775f49

  • SHA512

    dc429315e8138dd5fcf44b136b1f6ebd5865f563cb15a24ce41ecd37620dcf23c12cc7901ffa8ca4f21848bb052ec9c1919149383c8778cb6dbbdd3714e0a158

  • SSDEEP

    98304:Bn0yk8bSv0M9j7ktyYxyLmu5LLGXdof+AHRk8A+OTLpyX92jxDwpsGVjI24:Wj9jYp3N8+AvOsAjGpsmjI2

Score
10/10
elysiumstealerdiscoveryevasionstealerthemidatrojan

Malware Config

Targets

    • Target

      KayZer.exe

    • Size

      6.0MB

    • MD5

      7988a817d0491d1cd117c2557a984697

    • SHA1

      d8d5581e2480ea04a7840bc787981ab52a7e81ae

    • SHA256

      3689a3d591ab4d7a7861ba1445aba8707da08011e01d34828858ffecbe775f49

    • SHA512

      dc429315e8138dd5fcf44b136b1f6ebd5865f563cb15a24ce41ecd37620dcf23c12cc7901ffa8ca4f21848bb052ec9c1919149383c8778cb6dbbdd3714e0a158

    • SSDEEP

      98304:Bn0yk8bSv0M9j7ktyYxyLmu5LLGXdof+AHRk8A+OTLpyX92jxDwpsGVjI24:Wj9jYp3N8+AvOsAjGpsmjI2

    Score
    10/10
    elysiumstealerdiscoveryevasionstealerthemidatrojan

    • ElysiumStealer

      ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

      stealerelysiumstealer

    • ElysiumStealer Support DLL

    • Elysiumstealer family

      elysiumstealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks