Threat reportMalwareTL-2026-5108
ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
Joe Security documents ScarfaceStealer, a Windows stealer delivered as an NSIS-packaged Electron application (ClaudeMythos.exe) through a four-stage chain. It uses an 11-check weighted anti-sandbox score (threshold >=7) with FNV-1a string hashing, and an AES-256-CBC encrypted C2 configuration retrievable from a Polygon smart contract (EtherHiding-style). First disclosed .
Key facts for ScarfaceStealer Electron loader
| Identifiers | TL-2026-5108 |
|---|---|
| Severity | MEDIUM |
| First disclosed | |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows |
| Malware | ScarfaceStealer |
| Tools | NSIS |
| MITRE ATT&CK techniques | T1027 Obfuscated Files or Information, T1033 System Owner/User Discovery, T1057 Process Discovery, T1059.001 Command and Scripting Interpreter: PowerShell, T1059.007 Command and Scripting Interpreter: JavaScript, T1071.001 Application Layer Protocol: Web Protocols, T1082 System Information Discovery, T1140 Deobfuscate/Decode Files or Information, T1204.002 User Execution: Malicious File, T1497.001 Virtualization/Sandbox Evasion: System Checks, T1497.003 Time Based Checks, T1573.001 Encrypted Channel: Symmetric Cryptography |
| Motivation | FINANCIAL |
| Detection rules | 9 (1 shown free) |
| Sources | 6 cited sources |
Detection coverage for ScarfaceStealer Electron loader
As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5108 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: ScarfaceStealer ClaudeMythos Electron Loader Execution
Detects launch of ClaudeMythos.exe, the NSIS-dropped Electron application that hosts the obfuscated JavaScript loader of ScarfaceStealer, and execution of the two known ScarfaceStealer SHA-256 samples. This is the first observable step of the four-stage chain.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1204.002, T1059.007, T1027, T1140
- Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=1
| search (Image="*\\ClaudeMythos.exe" OR OriginalFileName="ClaudeMythos.exe" OR Hashes="*42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2*" OR Hashes="*2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent_image values(Hashes) as hashes by host, User, Image
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
union DeviceProcessEvents, DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "ClaudeMythos.exe" or ProcessVersionInfoOriginalFileName =~ "ClaudeMythos.exe" or SHA256 in~ ("42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2", "2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262")
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp descSigma
title: ScarfaceStealer ClaudeMythos Electron Loader Execution
id: 5b1d7a64-3c0e-4f58-9a27-6e8c1f0b4d21
status: experimental
description: Detects execution of ClaudeMythos.exe, the NSIS-dropped Electron loader used by ScarfaceStealer, or execution of binaries matching known ScarfaceStealer SHA-256 hashes.
references:
- https://www.joesecurity.org/blog/691434271001776522
- https://attack.mitre.org/techniques/T1497/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.007
- attack.defense-evasion
- attack.t1027
- attack.t1140
logsource:
category: process_creation
product: windows
detection:
selection_name:
- Image|endswith: '\ClaudeMythos.exe'
- OriginalFileName: 'ClaudeMythos.exe'
selection_hash:
Hashes|contains:
- '42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2'
- '2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262'
condition: 1 of selection_*
falsepositives:
- Legitimate software that happens to use the name ClaudeMythos.exe
level: high
Known false positives:
- Software legitimately named ClaudeMythos.exe
- Malware analysts or sandboxes detonating the known samples
Tuning notes: Scope to endpoints with Sysmon EventCode 1; add a hash lookup for new ScarfaceStealer builds and baseline any legitimate application using the same file name.
- ScarfaceStealer ClaudeMythos Electron Loader Execution · unlock with TL Creds
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) · unlock with TL Creds
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup · unlock with TL Creds
- ScarfaceStealer ClaudeMythos Electron Loader Execution · unlock with TL Creds
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) · unlock with TL Creds
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup · unlock with TL Creds
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) · unlock with TL Creds
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup · unlock with TL Creds
Indicators of compromise for ScarfaceStealer Electron loader
As of 2026-11-02, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5108.
Sample indicators (3 of 9)
- Domain:
check[.]mentor-square80[.]click - URL:
hxxps://polygon[.]drpc[.]org - File hash:
42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2
Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.
Community OSINT corroboration for ScarfaceStealer Electron loader
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
How ScarfaceStealer Electron loader works
ScarfaceStealer is delivered through a four-stage chain. Stage 1 is an NSIS installer that drops an Electron application named ClaudeMythos.exe. Stage 2 is an obfuscated JavaScript loader inside the Electron app. Stage 3 applies four decryption layers and maps an embedded PE. Stage 4 is the final ScarfaceStealer payload, which contains the scoring-based anti-analysis logic.
The JavaScript loader performs hardware checks before decrypting the next stage. It exits silently via app.quit() and process.exit(0) if the host has less than 4 GB of RAM or fewer than 2 CPU cores. It queries Win32_VideoController through PowerShell and checks the GPU name against the strings nvidia, radeon, intel and amd. The GPU check is wrapped in empty exception handlers, and timeouts allow execution to continue.
The final payload combines 11 anti-sandbox indicators into a suspicion score. A score of 7 or more sends the sample into a decoy loop. The checks are: process-name blocklist (68 entries covering debuggers, reversing tools, network and process monitors, and virtualization services including JoeBox), CPU core count, physical RAM, GPU name allowlist (nvidia, radeon, intel, qualcomm), username blocklist (20 entries, e.g. sandbox, malware, cuckoo, vmware, test, sample), system uptime, sleep timing, remote-session (RDP) detection, CPU latency via __cpuid (<=1500 cycles considered normal), CPU vendor/brand consistency, and GPU PCI vendor ID blocklist (0x1234, 0x15AD, 0x80EE, 0x1B36, 0x1AF4, 0x1AE0). Strings are hidden with a modified FNV-1a hash using seed 0xeb1af681 instead of the standard 0x811c9dc5, computed over lowercase UTF-16LE.
The C2 configuration can be retrieved from the blockchain. The sample issues a JSON-RPC eth_call with selector 0xd040556c to contract 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 on Polygon via https://polygon.drpc.org. The ABI-encoded return value is AES-256-CBC encrypted and decrypts to a C2 endpoint matching the embedded configuration, so the contract acts as a fallback or alternative config source. The observed C2 is check.mentor-square80.click over port 443, URI /api/v3/health, with a Chrome/146 style User-Agent.
The Joe Security source does not state an actor, victimology, target sectors, or the stealer's data-theft targets, and no CVE is involved. Distribution vector (how victims obtain the installer) is not described in the source. Severity is analyst-assigned.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1497.003 Time Based Checks
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography
Remediation for ScarfaceStealer Electron loader
Immediate actions
- Block check.mentor-square80.click at DNS and proxy; alert on requests to /api/v3/health with the Chrome/146 Windows NT 10.0 User-Agent
- Hunt for ClaudeMythos.exe and NSIS-installed Electron apps launching PowerShell queries of Win32_VideoController
- Alert on endpoint egress to polygon.drpc.org or other public Ethereum/Polygon JSON-RPC endpoints from non-blockchain workstations
- Search EDR/file telemetry for SHA-256 42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2 and 2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262
Workarounds
- If infection is suspected, isolate the host and rotate credentials and sessions that were usable from it
Longer-term hardening
- Restrict installation of unsigned or unapproved Electron/NSIS applications via application control
- Block or monitor outbound JSON-RPC to public blockchain gateways where there is no business need
- Detonate suspicious installers on sandboxes with realistic hardware profiles (4+ GB RAM, 2+ cores, real GPU names, plausible usernames and uptime), since ScarfaceStealer evades low-fidelity analysis environments
Affected and fixed versions
- Microsoft — Windows
Vulnerable versions: Windows 10 and later (User-Agent claims Windows NT 10.0)
Timeline of ScarfaceStealer Electron loader
- Payload queries Polygon contract locked-ioc-4 via polygon.drpc.org (eth_call, selector 0xd040556c); the AES-256-CBC encrypted return value decrypts to the C2 endpoint locked-ioc-5.
- Final payload found to combine 11 anti-sandbox indicators into a suspicion score; a score of 7 or more triggers a decoy loop. Strings are hidden with FNV-1a using custom seed 0xeb1af681.
- Electron loader exits silently on <4 GB RAM or <2 CPU cores and checks the Win32_VideoController GPU name (nvidia, radeon, intel, amd) via PowerShell.
- Four-stage chain documented: locked-ioc-9 installer drops Electron app locked-ioc-7, obfuscated JavaScript loader, third stage with four decryption layers and an embedded PE, then the locked-ioc-8 payload.
- Joe Security publishes 'Inside locked-ioc-8's Sandbox-Aware Anti-Analysis System', the first public analysis of the family used by this record.
- Threadlinqs research phase completed for TL-2026-5108; BeaconBeagle config lookup for locked-ioc-5 returned HTTP 502 and could not be used for correlation.
Sources cited for ScarfaceStealer Electron loader
- Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System joesecurity.org · Research · 2026-07-14
- MITRE ATT&CK T1102 Web Service MITRE · Research
- MITRE ATT&CK T1497 Virtualization/Sandbox Evasion MITRE · Research
- MITRE ATT&CK T1059.007 JavaScript MITRE · Research
- MITRE ATT&CK T1573.001 Symmetric Cryptography MITRE · Research
- Joe Security Blog (alternate URL for the ScarfaceStealer analysis) joesecurity.org · Blog · 2026-07-14
Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.
