Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System
Published on: 14.07.2026
Introduction
In this blog post, we examine a multi-stage ScarfaceStealer infection chain delivered through an Electron-based application packaged with NSIS.
The investigation began with a Joe Sandbox Cloud Basic analysis https://www.joesandbox.com/analysis/1915862/0/html that produced only limited behavioral indicators, suggesting that the sample did not fully expose its intended execution path. The filename ClaudeMythos.exe, however, stood out as a lure likely targeting users interested in AI-related tools and prompted a deeper look into the sample.
Unpacking the Electron application exposed a second-stage JavaScript-based loader that performs initial evasion checks before decrypting and executing the next stage. That third stage applies four additional decryption layers, maps an embedded PE in memory, and transfers execution to it.
The recovered final stage revealed the core anti-sandbox logic: a scoring-based mechanism used to decide whether the ScarfaceStealer payload should continue execution.
This case highlights how modern stealers increasingly distribute anti-analysis logic across multiple stages, protecting not only the initial loader but also the final payload execution path.
Electron Loader Evasion in the Second-Stage
The first evasion layer is implemented inside the Electron application's main.js entry point. Since the script was heavily obfuscated, we first removed the initial obfuscation layer using https://deobfuscate.io/, and then submitted the cleaned code to Joe Reverser for automated reverse engineering: https://www.joesandbox.com/joereverser/analysis/download/df4d795d-341f-4d9e-93fa-77fb24d92793?type=html.
Before decrypting and launching the next stage, the JavaScript loader performs a set of environment checks intended to evade sandbox environments. Execution is immediately terminated if the host exposes less than 4 GB of RAM or fewer than two CPU cores. In both cases, the loader calls app.quit() followed by process.exit(0), causing the application to exit silently before the next stage is decrypted.
The loader also verifies the graphics environment by querying Win32_VideoController through PowerShell and checking the returned GPU name against common vendor strings such as nvidia, radeon, intel, and amd. If none of these values are present, the process exits silently. Notably, this check is wrapped in an empty exception handler. If the PowerShell command fails, returns an unexpected result, or times out, the validation is skipped and execution continues. As a result, the GPU check acts as an opportunistic sandbox filter rather than a hard requirement.
To better illustrate the behavior of this first evasion layer, we converted the relevant JavaScript logic into a small PowerShell proof of concept script. The purpose of this PoC was not to reproduce the loader completely, but to isolate the environment checks and make their decision logic easier to validate:
This confirms that modern malware increasingly relies on hardware-based heuristics to distinguish real endpoints from analysis environments. To trigger the intended execution path reliably, a sandbox must therefore expose hardware characteristics that resemble a genuinely attractive target, including adequate memory, multiple CPU cores, and a realistic graphics stack.
Joe Sandbox supports dynamic analysis on bare-metal systems, executing samples directly on physical hardware rather than in a virtualized environment. By leveraging real computers for analysis, it inherently avoids hardware-based sandbox detection techniques that rely on identifying virtualized or emulated hardware characteristics.
Scoring Based Evasion in the Final Stage
After bypassing the first evasion layer inside the Electron loader, execution reached a second anti-analysis stage in the final payload. Unlike the loader, this stage does not rely on a single failed check to terminate execution. Instead, it evaluates the host through 11 indicators and combines their results into a weighted suspicion score.
Using Joe Reverser Expert Mode, we mapped how each check contributes to the final decision and how the malware determines whether the host is realistic enough to continue with payload execution.
The full analysis is available here: https://www.joesandbox.com/joereverser/analysis/download/ad36c5da-4d4b-4d0c-bbb2-ae5328ba5cfa?type=html.
The routine FUN_140006d08 combines the results of all anti-sandbox checks into a single weighted score. Each indicator contributes a different value depending on its significance.
If the final score reaches 7 or higher, the host is classified as suspicious and the stealer payload execution path is not reached. As a result the malware enters a decoy loop that continuously displays random message boxes: each time one dialog is closed, another one is shown. If the score remains below 7, execution continues toward the real payload.
0xeb1af681) instead of the standard offset basis (0x811c9dc5). Since the resulting hashes are one-way transformations, the original strings cannot be recovered directly.We reconstructed the hashed entries through brute force and dictionary matching. The reconstructed lists are included in the appendices:
- "Appendix A. Check id=0 Process Name Blocklist"
- "Appendix B. Check id=3 GPU Name Allowlist"
- "Appendix C. Check id=4 Username Blocklist"
- "Appendix D. Check id=10 GPU Vendor Blocklist"
Once the hashed indicators had been reconstructed, we implemented a C++ proof of concept that reproduces the anti-analysis decision logic described by Joe Reverser Expert Mode. The PoC combines all 11 checks into a single test harness, making it possible to validate the scoring logic, inspect the contribution of each condition, and determine whether the sample would proceed toward payload execution.
The execution output produced during our analysis with a score of 2 (<7) is included in Appendix E. Appendix F contains the link to the PoC code, while the full PoC analysis is available at the following link:
https://www.joesandbox.com/analysis/1940467/0/html
After incorporating the insights from the PoC we re-ran the sample in Joe Sandbox and obtained a successful execution. The updated environment was able to satisfy the malware's anti-sandbox requirements and expose the next stage of its behavior, confirming that the reconstructed checks had been correctly understood and addressed.
The successful Joe Sandbox analysis, together with the corresponding screenshot, is available at the following link:
https://www.joesandbox.com/analysis/1940471/0/html
This layered design suggests that the malware author aimed to protect the entire infection chain, not just the initial loader. Even after the first layer is bypassed, the final stage introduces additional evasion logic before the payload behavior is exposed.
Joe Reverser helped speed up the investigation by making these evasion layers easier to identify, understand, and validate.
Malware Family Attribution
At this point, we performed a broader Joe Reverser analysis of the same final stage, focusing on Threat Intelligence and IOCs extraction: https://www.joesandbox.com/joereverser/analysis/download/88df7947-5c7e-4e03-978b-18c2dd143ae2?type=html.
The sample contains an embedded C2 configuration for check.mentor-square80.click:443.
It also queries the Polygon smart contract 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 through an Ethereum-compatible JSON-RPC eth_call, using the selector 0xd040556c. The contract likely provides an alternative or fallback source for the malware's C2 configuration. This technique is commonly associated with the EtherHiding ecosystem.
curl https://polygon.drpc.org -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x25C73C98F0E509Bd909cd1C1456EB973Dda60344","data":"0xd040556c"}],"id":1}'
The call returns the following response:
{"id":1,"jsonrpc":"2.0","result":"0x00000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000060613861396530386235383138626439343539626435306563393561633163636131306638656135616634356163303635626466383662323864343734616337623265613464333561313162623032396163346165623166616465623563343462"}
The returned value is ABI-encoded (hexadecimal with left zero padding). In many similar cases, the decoded value directly contains the C2 endpoint. In this sample, however, the decoded blob appears to be encrypted:
a8a9e08b5818bd9459bd50ec95ac1cca10f8ea5af45ac065bdf86b28d474ac7b2ea4d35a11bb029ac4aeb1fadeb5c44b
Joe Reverser Expert Mode identified an AES-256-CBC decryption routine while inspecting the HTTP request handler (FUN_140008268). Decrypting the retrieved ABI-decoded value produced an endpoint matching the C2 configuration already embedded in the sample:
C2 host: check.mentor-square80.click
C2 port: 443
At the time of the analysis, the URL did not receive any reports on VirusTotal:
https://www.virustotal.com/gui/url/b9d3bd64c33371dab4a93a9270df33b396182d998d13353b85493f3397188e0f
The domain relations also highlight a closely related sample:
https://www.virustotal.com/gui/file/2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262
After additional pivoting in VirusTotal and by comparing similar analyses in Joe Sandbox Cloud Basic, we were able to attribute this sample to the ScarfaceStealer malware family: https://www.joesandbox.com/analysis/search?q=ScarfaceStealer.
Conclusion
This case shows how modern stealers increasingly distribute anti-analysis logic across the full infection chain. The Electron loader filters out analysis environments through hardware heuristics, while the final stage applies a weighted scoring system before allowing the ScarfaceStealer payload to execute.
By combining dynamic analysis, Joe Reverser, and bare metal analysis, we reconstructed the anti-analysis logic, identified the conditions that prevented payload execution, and adapted the analysis environment to bypass the malware's evasion checks.
Joe Reverser made these deeper evasion layers easier to understand and validate at scale, turning heavily obfuscated code into actionable insight for anti-evasion tuning and successful payload execution.
Would you like to try Joe Reverser or Joe Sandbox? Register for a free account on Joe Sandbox Cloud Basic and start using it!
Indicators of Compromise (IOCs)
SHA-256:
- 42b9c406d5569b9619c980b336d3236ac7f7789db57ba3b31cd79c463e6f2ca2
- 2cdf5a3a344220ee41b7f509714f694b25bf435d838728f57845ec58d1899262
C2 domains:
- check.mentor-square80.click
URIs:
- /api/v3/health
User-Agent:
- Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Appendix A. Check id=0 Process Name Blocklist
Appendix B. Check id=3 GPU Name Allowlist
Appendix C. Check id=4 Username Blocklist
0x966EA0AA // miller
0x6D2AB6D0 // malware
0x6BA382EF // maltest
0x854D8BEC // johndoe
0xF8A8714C // sandbox
0x0EF62EBA // virus
0x767A179C // john doe
0xB9184372 // ba5wjx (probably hash collision)
0x5A7EB0B4 // a u4l1 (probably hash collision)
0x7F1C2975 // _c9j12 (probably hash collision)
0x4490D09D // bruno
0x1C9436CC // george
0x69C2D508 // <not found>
0xF6C2B2AF // test
0x20AB9BF7 // sample
0xA7E472E3 // analysis
0x2410B3A7 // cuckoo
0xAC7D9203 // vmware
0x17518351 // lichao