# ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2

> ScarfaceStealer is an actively distributed Windows infostealer family (tracked since December 2025) whose latest build, analyzed by Joe Security on 2026-07-14, is delivered via an NSIS-packaged Electron application masquerading as an AI tool named ClaudeMythos.exe. The dropper performs hardware-based sandbox checks before a final payload scores eleven environmental indicators and, if it passes, retrieves its C2 address from an Ethereum/Polygon smart contract using an EtherHiding-style dead-drop resolver.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2455
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-scarfacestealer-ethereum-smart-contract-c2-tl-2026-2455.webp?v=89b984a2 (Threadlinqs threat intel: ScarfaceStealer Ethereum Smart Contract C2: Detection & IOCs (TL-2026-2455) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-2455
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (3 shown free below)

## Description

ScarfaceStealer is a Windows information-stealer family first observed in the wild on 2025-12-03 (MalwareBazaar), with 196 tracked samples submitted through at least 2026-08-10. An earlier, Go-compiled build documented by SonicWall on 2026-03-15 (internally flagged as ScarfaceStealer.Rocket) targets browser cookies, saved passwords, browsing history and autofill data, alongside hardware fingerprinting, network configuration, installed-software enumeration, and functions consistent with microphone and screenshot capture. That build is heavily obfuscated with space/rocket-themed junk strings and randomly concatenated English-word function names (e.g. LAUNCH_COMMAND, TELEMETRY, IGNITION, MISSION_ABORT), leaving only 47 human-readable strings visible under static analysis, and exfiltrates over HTTP/TLS.

The variant analyzed by Joe Security on 2026-07-14 represents a distribution and anti-analysis evolution of the same family. It is delivered as an NSIS-packaged Electron application disguised as an AI-themed utility named ClaudeMythos.exe (sibling lures observed for the family include Kitchen Canvas, Food or Meal Formula, and DocConvertWizard). Infection proceeds in two evasion stages: (1) the Electron/JavaScript loader enforces minimum hardware thresholds (>=4GB RAM, >=2 CPU cores) and validates the GPU vendor via a PowerShell query against the Win32_VideoController WMI class, silently exiting via app.quit()/process.exit(0) if unmet; (2) the unpacked final payload runs a weighted 11-indicator sandbox-suspicion scorer covering analysis-tool/debugger process names, CPU core count, physical RAM, GPU vendor allow-list, username blocklist, system uptime plausibility, sleep-timing accuracy, remote-session detection (GetSystemMetrics/SM_REMOTESESSION), CPU instruction (__cpuid) timing, CPUID leaf vendor/brand consistency, and GPU PCI vendor-ID blocklisting against common hypervisor IDs (QEMU/BOCHS 0x1234, VMware 0x15AD, VirtualBox 0x80EE, QEMU VirtIO 0x1B36, Red Hat VirtIO 0x1AF4, Google Compute Engine 0x1AE0). A score of 7 or higher routes execution into a decoy loop of continuous message boxes instead of the payload. Internal strings are protected with a modified FNV-1a hash (UTF-16LE, custom seed 0xeb1af681 rather than the standard 0x811c9dc5).

Once evasion checks pass, the payload retrieves its C2 configuration from the Polygon blockchain by issuing an eth_call (function selector 0xd040556c) against the smart contract at 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 via the public RPC endpoint polygon.drpc.org. The ABI-encoded response is decoded and then decrypted with AES-256-CBC to yield the live C2 endpoint check.mentor-square80.click:443, which is subsequently queried at the path /api/v3/health using a static Chrome 146 User-Agent string. This dead-drop-resolver pattern -- storing and rotating C2 addresses inside a public, takedown-resistant smart contract rather than DNS/IP infrastructure -- places the sample in the broader 'EtherHiding' technique family also used by malware such as EtherRAT and Tsundere (per eSentire's 2026-03-25 analysis), which similarly abuse Ethereum/BNB smart contracts and public RPC providers to survive infrastructure takedowns and re-task already-compromised hosts.

The ClaudeMythos.exe lure specifically targets users seeking AI tools, aligning with the broader trend of trojanized 'AI utility' Electron apps used as an infostealer delivery vector.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1036 Masquerading
- T1497.001 System Checks
- T1497.003 Time Based Checks
- T1622 Debugger Evasion
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1113 Screen Capture
- T1123 Audio Capture
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ScarfaceStealer — ClaudeMythos.exe Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController** (`TL-2026-2455-SPL-001`)

Detects execution of the ScarfaceStealer trojanized Electron/NSIS lure (ClaudeMythos.exe, or sibling lures Kitchen Canvas / Food or Meal Formula / DocConvertWizard) followed within a short window by a PowerShell query against the Win32_VideoController WMI class, which the Electron-stage loader uses to validate the GPU vendor before unpacking the final payload. The two-event correlation distinguishes this from routine hardware-inventory PowerShell use.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036, T1059.001, T1027.002
- **Data sources:** sysmon, windows_security, powershell_operational, edr_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(Image, "(?i)\\\\(ClaudeMythos\.exe|Kitchen ?Canvas\.exe|Food ?or ?Meal ?Formula\.exe|DocConvertWizard\.exe)$") OR match(CommandLine, "(?i)ClaudeMythos|Kitchen Canvas|Food or Meal Formula|DocConvertWizard")
| eval lure_time=_time, lure_host=ComputerName, lure_image=Image, lure_guid=ProcessGuid
| join type=left ComputerName
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\powershell.exe" CommandLine="*Win32_VideoController*"
      | eval ps_time=_time
      | fields ComputerName, ps_time, CommandLine, ParentImage, User ]
| where isnotnull(ps_time) AND (ps_time - lure_time) >= 0 AND (ps_time - lure_time) <= 120
| table lure_time, lure_host, lure_image, User, CommandLine, ps_time
| sort - lure_time
```

### Microsoft KQL

```kql
let LureProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("ClaudeMythos.exe") or ProcessCommandLine has_any ("ClaudeMythos", "Kitchen Canvas", "Food or Meal Formula", "DocConvertWizard")
| project LureTime = Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessAccountName;
let WmiGpuQuery = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe" and ProcessCommandLine has "Win32_VideoController"
| project WmiTime = Timestamp, DeviceId, ProcessCommandLine;
LureProcess
| join kind=inner WmiGpuQuery on DeviceId
| where WmiTime - LureTime between (0min .. 5min)
| project LureTime, WmiTime, DeviceName, FileName, SHA256, ProcessCommandLine, InitiatingProcessAccountName
| sort by LureTime desc
```

### Sigma

```yaml
title: ScarfaceStealer ClaudeMythos Lure Execution or GPU Fingerprint via Win32_VideoController
id: 7c1e9f2a-3b5d-4e6a-9a1c-2f8d4b6e7a10
status: experimental
description: Detects execution of the ScarfaceStealer Electron/NSIS lure (ClaudeMythos.exe and sibling lure names) or a PowerShell query against Win32_VideoController consistent with the family's GPU-vendor pre-check.
references:
  - https://www.joesecurity.org/blog/691434271001776522
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1036
  - attack.t1027.002
  - attack.software_packing
logsource:
  category: process_creation
  product: windows
detection:
  selection_lure_image:
    Image|endswith:
      - '\ClaudeMythos.exe'
      - '\DocConvertWizard.exe'
  selection_lure_cmdline:
    CommandLine|contains:
      - 'ClaudeMythos'
      - 'Kitchen Canvas'
      - 'Food or Meal Formula'
      - 'DocConvertWizard'
  selection_wmi_gpu_check:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: 'Win32_VideoController'
  condition: selection_lure_image or selection_lure_cmdline or selection_wmi_gpu_check
falsepositives:
  - IT asset-management or hardware-inventory scripts querying Win32_VideoController
  - Legitimate software sharing a coincidentally similar generic filename
level: high
```

**Known false positives:**

- Legitimate IT asset-management or hardware-inventory PowerShell scripts querying Win32_VideoController
- Users installing an unrelated legitimate application that happens to share a generic lure filename pattern

**Tuning notes:** Narrow the Win32_VideoController correlation window to <=60s after installer execution to reduce noise from unrelated periodic inventory jobs; allowlist known IT asset-management scripts by code-signing hash/signer.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ScarfaceStealer — [indicator] Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController (locked: unlock with TL Creds)
- ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] (locked: unlock with TL Creds)
- ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon (locked: unlock with TL Creds)
- ScarfaceStealer — [indicator] Electron/NSIS Lure Execution + GPU Fingerprint via Win32_VideoController (locked: unlock with TL Creds)
- ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] (locked: unlock with TL Creds)
- ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon (locked: unlock with TL Creds)
- ScarfaceStealer — Non-Browser Access to Browser Credential Stores or Analysis-Tool Process Enumeration by [indicator] (locked: unlock with TL Creds)
- ScarfaceStealer — Polygon Smart-Contract Dead-Drop C2 Resolution and [indicator] Beacon (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 15)

Defanged, TLP:CLEAR.

- Domain: `check[.]mentor-square80[.]click`
- File hash: `42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2`
- File hash: `2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System](https://www.joesecurity.org/blog/691434271001776522)
- [An In-Depth Look at Scarface Stealer](https://www.sonicwall.com/blog/an-in-depth-look-at-scarface-stealer)
- [MalwareBazaar | ScarfaceStealer](https://bazaar.abuse.ch/browse/signature/ScarfaceStealer/)
- [ThreatFox - Tag ScarfaceStealer](https://threatfox.abuse.ch/browse/tag/ScarfaceStealer/)
- [EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons](https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2455