rapid_stealer | 0b6efae9bc7d9cab0a4e135b855f34cc940cfe596761d26e72a11e0f850f23ae

General

Target
OblivionPath Setup 1.0.0.exe
Size 98.1MB
Sample260809-n4faaaxcmd
SHA256 0b6efae9bc7d9cab0a4e135b855f34cc940cfe596761d26e72a11e0f850f23ae
MD5 a8e372c229cb6e7020a44fb1da298c8f
SHA1 6ded02d43406ee24710020d10323c7d8a75a262a
SHA512 7b8f14d6705bb6e057e616578770737b856bf740af2f73105a8ad9a64dfcd1a32c3bae16c9330953d14a35ff37a71ba7249761cc0f654aeae133b1bc98b85c0c
SSDEEP 1572864:cxlH6jZTugux2qzsaY1mj3Of7LqFdzLcBdyNyBAnScV/e1DjvSe11or:cxN6d22TPqFdncBdyNPScV/MT1i
TLSH
T12A38339D8033147DE5BBEE3AD25AFDF3458734FD6BA09983C3976AB63A116044E2064C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  OblivionPath Setup 1.0.0.exe
- Size 98.1MB
- SHA256 0b6efae9bc7d9cab0a4e135b855f34cc940cfe596761d26e72a11e0f850f23ae
- MD5 a8e372c229cb6e7020a44fb1da298c8f
- SHA1 6ded02d43406ee24710020d10323c7d8a75a262a
- SHA512 7b8f14d6705bb6e057e616578770737b856bf740af2f73105a8ad9a64dfcd1a32c3bae16c9330953d14a35ff37a71ba7249761cc0f654aeae133b1bc98b85c0c
- SSDEEP 1572864:cxlH6jZTugux2qzsaY1mj3Of7LqFdzLcBdyNyBAnScV/e1DjvSe11or:cxN6d22TPqFdncBdyNPScV/MT1i
- TLSH
  T12A38339D8033147DE5BBEE3AD25AFDF3458734FD6BA09983C3976AB63A116044E2064C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution rapid_stealer persistence privilege_escalation spyware stealer trojan
- Detects RapidStealer payload
- Family: RapidStealer
  RapidStealer is an infostealer based on Electron.
  stealer rapid_stealer
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  OblivionPath.exe
- Size 192.1MB
- SHA256 6e2153b3930aa6aa0c3c2ef6d2e906679435ddff925d2346716e34e149f1196e
- MD5 47026031670d11bc0ce12a3c46c867ee
- SHA1 90ec31f79dc44483e782126ae2ba72fe9cb7f7e7
- SHA512 9a4dccb6dd6db8fb34ce1e5573d853f4544450614fc1751ed2f190312b89aa9654c19400c1213ab1807de9177655bc35ddb328cfa280045e58104abab3263f1f
- SSDEEP 1572864:3hqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709x5:qOMMpBKvPTJJlf
- TLSH
  T1F4A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2