# ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)

> Joe Security documents ScarfaceStealer, a Windows stealer delivered as an NSIS-packaged Electron application (ClaudeMythos.exe) through a four-stage chain. It uses an 11-check weighted anti-sandbox score (threshold >=7) with FNV-1a string hashing, and an AES-256-CBC encrypted C2 configuration retrievable from a Polygon smart contract (EtherHiding-style).

- **Published:** 2026-11-02T23:58:17Z
- **Last reviewed:** 2026-11-02T23:58:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5108
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5108.png
- **ID:** TL-2026-5108
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (3 shown free below)

## Description

ScarfaceStealer is delivered through a four-stage chain. Stage 1 is an NSIS installer that drops an Electron application named ClaudeMythos.exe. Stage 2 is an obfuscated JavaScript loader inside the Electron app. Stage 3 applies four decryption layers and maps an embedded PE. Stage 4 is the final ScarfaceStealer payload, which contains the scoring-based anti-analysis logic.

The JavaScript loader performs hardware checks before decrypting the next stage. It exits silently via app.quit() and process.exit(0) if the host has less than 4 GB of RAM or fewer than 2 CPU cores. It queries Win32_VideoController through PowerShell and checks the GPU name against the strings nvidia, radeon, intel and amd. The GPU check is wrapped in empty exception handlers, and timeouts allow execution to continue.

The final payload combines 11 anti-sandbox indicators into a suspicion score. A score of 7 or more sends the sample into a decoy loop. The checks are: process-name blocklist (68 entries covering debuggers, reversing tools, network and process monitors, and virtualization services including JoeBox), CPU core count, physical RAM, GPU name allowlist (nvidia, radeon, intel, qualcomm), username blocklist (20 entries, e.g. sandbox, malware, cuckoo, vmware, test, sample), system uptime, sleep timing, remote-session (RDP) detection, CPU latency via __cpuid (<=1500 cycles considered normal), CPU vendor/brand consistency, and GPU PCI vendor ID blocklist (0x1234, 0x15AD, 0x80EE, 0x1B36, 0x1AF4, 0x1AE0). Strings are hidden with a modified FNV-1a hash using seed 0xeb1af681 instead of the standard 0x811c9dc5, computed over lowercase UTF-16LE.

The C2 configuration can be retrieved from the blockchain. The sample issues a JSON-RPC eth_call with selector 0xd040556c to contract 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 on Polygon via https://polygon.drpc.org. The ABI-encoded return value is AES-256-CBC encrypted and decrypts to a C2 endpoint matching the embedded configuration, so the contract acts as a fallback or alternative config source. The observed C2 is check.mentor-square80.click over port 443, URI /api/v3/health, with a Chrome/146 style User-Agent.

The Joe Security source does not state an actor, victimology, target sectors, or the stealer's data-theft targets, and no CVE is involved. Distribution vector (how victims obtain the installer) is not described in the source. Severity is analyst-assigned.

## MITRE ATT&CK

- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.002 User Execution: Malicious File
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1497.003 Time Based Checks
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ScarfaceStealer ClaudeMythos Electron Loader Execution** (`TL-2026-5108-SPL-001`)

Detects launch of ClaudeMythos.exe, the NSIS-dropped Electron application that hosts the obfuscated JavaScript loader of ScarfaceStealer, and execution of the two known ScarfaceStealer SHA-256 samples. This is the first observable step of the four-stage chain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1027, T1140
- **Data sources:** sysmon, windows_process_creation, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=1
| search (Image="*\\ClaudeMythos.exe" OR OriginalFileName="ClaudeMythos.exe" OR Hashes="*42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2*" OR Hashes="*2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent_image values(Hashes) as hashes by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
union DeviceProcessEvents, DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "ClaudeMythos.exe" or ProcessVersionInfoOriginalFileName =~ "ClaudeMythos.exe" or SHA256 in~ ("42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2", "2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262")
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: ScarfaceStealer ClaudeMythos Electron Loader Execution
id: 5b1d7a64-3c0e-4f58-9a27-6e8c1f0b4d21
status: experimental
description: Detects execution of ClaudeMythos.exe, the NSIS-dropped Electron loader used by ScarfaceStealer, or execution of binaries matching known ScarfaceStealer SHA-256 hashes.
references:
    - https://www.joesecurity.org/blog/691434271001776522
    - https://attack.mitre.org/techniques/T1497/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1027
    - attack.t1140
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        - Image|endswith: '\ClaudeMythos.exe'
        - OriginalFileName: 'ClaudeMythos.exe'
    selection_hash:
        Hashes|contains:
            - '42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2'
            - '2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software that happens to use the name ClaudeMythos.exe
level: high

```

**Known false positives:**

- Software legitimately named ClaudeMythos.exe
- Malware analysts or sandboxes detonating the known samples

**Tuning notes:** Scope to endpoints with Sysmon EventCode 1; add a hash lookup for new ScarfaceStealer builds and baseline any legitimate application using the same file name.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ScarfaceStealer ClaudeMythos Electron Loader Execution (locked: unlock with TL Creds)
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) (locked: unlock with TL Creds)
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup (locked: unlock with TL Creds)
- ScarfaceStealer ClaudeMythos Electron Loader Execution (locked: unlock with TL Creds)
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) (locked: unlock with TL Creds)
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup (locked: unlock with TL Creds)
- ScarfaceStealer Loader PowerShell GPU Query (Win32_VideoController Sandbox Check) (locked: unlock with TL Creds)
- ScarfaceStealer C2 Domain and Polygon eth_call Config Lookup (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 9)

Defanged, TLP:CLEAR.

- Domain: `check[.]mentor-square80[.]click`
- URL: `hxxps://polygon[.]drpc[.]org`
- File hash: `42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System](https://www.joesecurity.org/blog/691434271001776522)
- [Joe Security Blog (alternate URL for the ScarfaceStealer analysis)](https://www.joesecurity.org/index.php/blog/691434271001776522)
- [MITRE ATT&CK T1102 Web Service](https://attack.mitre.org/techniques/T1102/)
- [MITRE ATT&CK T1497 Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)
- [MITRE ATT&CK T1059.007 JavaScript](https://attack.mitre.org/techniques/T1059/007/)
- [MITRE ATT&CK T1573.001 Symmetric Cryptography](https://attack.mitre.org/techniques/T1573/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5108