rapid_stealer | ff1db5a2d00f1472acacd8751c04a08d1982a088c88667b9dc1ef8e0c7aae998

General

Target
ElyraGame Setup 1.0.0.exe
Size 98.2MB
Sample260813-n449eaxyes
SHA256 ff1db5a2d00f1472acacd8751c04a08d1982a088c88667b9dc1ef8e0c7aae998
MD5 9ad502d07ca0819f9599ee1ced424c18
SHA1 67bd7d463cd7b92ccec2c7c63bafabc1bd309018
SHA512 ac6fd3712af633c998b08c64b6fe01ceff627d9fd39f69c4cade0b48c9823d6c0c74f7f05cce03e29d8cf4ea07d64bbbbf521e2e0092f69fbb2dd078dc51ce2f
SSDEEP 1572864:0DlH6skz0mlzDeY1r+j3Of7LqFdzLcBdyNyBAnScV/e1DjZSeR1z:0DN6HjJPqFdncBdyNPScV/MJR9
TLSH
T1283833868076627ED576EA39F16AFEB24087349C7EB09D83C7A72BDD3F240254D2124D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ElyraGame Setup 1.0.0.exe
- Size 98.2MB
- SHA256 ff1db5a2d00f1472acacd8751c04a08d1982a088c88667b9dc1ef8e0c7aae998
- MD5 9ad502d07ca0819f9599ee1ced424c18
- SHA1 67bd7d463cd7b92ccec2c7c63bafabc1bd309018
- SHA512 ac6fd3712af633c998b08c64b6fe01ceff627d9fd39f69c4cade0b48c9823d6c0c74f7f05cce03e29d8cf4ea07d64bbbbf521e2e0092f69fbb2dd078dc51ce2f
- SSDEEP 1572864:0DlH6skz0mlzDeY1r+j3Of7LqFdzLcBdyNyBAnScV/e1DjZSeR1z:0DN6HjJPqFdncBdyNPScV/MJR9
- TLSH
  T1283833868076627ED576EA39F16AFEB24087349C7EB09D83C7A72BDD3F240254D2124D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution rapid_stealer persistence privilege_escalation spyware stealer trojan
- Detects RapidStealer payload
- Family: RapidStealer
  RapidStealer is an infostealer based on Electron.
  stealer rapid_stealer
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  ElyraGame.exe
- Size 192.1MB
- SHA256 4161cf5938e5471bec3d8d2280850992c013468eabd3ef1924b5390f2c96a207
- MD5 560a475c6230c4ce20657f6f4fb01253
- SHA1 7124285952c5e52503f6ab12da00d40b45e460fd
- SHA512 b581dce7836ffab7acd92f814e6cd8646fd9e768e72013934623da8c0f9c6930555817d2a49ba2e512fd2ed25fb8069bdb703882ea0be1906c7569be8fc0c133
- SSDEEP 1572864:phqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709xy:YOMMpBKvPTJJlfc
- TLSH
  T1A0A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2