General
- Target Merluis.zip
- Size 116.7MB
- Sample260416-ppsshaft9m
- SHA256 71bf366f690036077650b19fdf215d9fcf601e210b9b7278ed18b94551c33e3d
Score
10/10
Malware Config
Targets
-
- Target Merluis.exe
- Size 116.7MB
- SHA256 a60007d2f163abc208e36a5e52d54e41d1b84b4b5ca6345d652089d92c00bc92
Score10/10Detects HadeStealer
Family: HadesStealer
HadesStealer is a Windows stealer based on ElectronJS.
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Looks for VMWare Tools registry key
Looks for VMWare services registry key.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates processes with tasklist
-
- Target Merluis.exe
- Size 212.5MB
- SHA256 2f8200c46a7e9a356c2c68b922043594e47f8e9187abaf7298906f495b8dc343
Score9/10Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Looks for VMWare services registry key.
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Adds Run key to start application
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Virtualization/Sandbox Evasion
5