rapid_stealer | 4215df99b6694506eefc65f5b65bff797897053297a01a3e726e90cdf76c77c0

General

Target
KitelGame Setup 1.0.0.7z
Size 96.7MB
Sample260821-pp85gsem4s
SHA256 4215df99b6694506eefc65f5b65bff797897053297a01a3e726e90cdf76c77c0
MD5 263485830c9857b7b38053aca079c6b1
SHA1 9127374ac5d9f5e33b1eb73260913b06d0ce77c1
SHA512 08fcf4fb2d8a7a03c0b3085d2cc00fffbfd7802ddee4533a3f0d223b160135d4c84c3520a33c95f7ae7a33722018cca28e3d65e831af42ac49513120bf3b876e
SSDEEP 1572864:ysllT7YzMnqoMU3WTuqyKr9yKm3jKm+xUZtVaFUG66Xk:ySl3ahyKrwKm3jKst96U
TLSH
T18728335C94B3457A90FB783DF182EEB0054639F93A6669C7D7FE3EAA3A718150730A04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  KitelGame Setup 1.0.0.exe
- Size 96.8MB
- SHA256 aca20770ceb84bbd03978bcdc29e32ad716fa1a7b2df022d59261e32cfab35de
- MD5 bf17cda3aca87a89c8dd63bbc06cbd1c
- SHA1 368b8494de9b24db74e6fdd4c6ce5bb7e785bc06
- SHA512 4a95dfcf5c2512e0dab4a339aa4455b63c89632d1a2cfabaa61acd01fa3c3525a110af4a47e813b35295bfe12246c3c2edc4d80aed45c9deef0162a02363b711
- SSDEEP 1572864:5WlH6OzcfGMY1/ej3Of7LqFdzLcBdyNyB13jSQDOq1Wh1Z:5WN6OYePqFdncBdyNsS7hD
- TLSH
  T17528335C84B3457AD0FB783DE182EEB0054639F93A566AC7D7FE3EAA3AB14150734A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution rapid_stealer stealer
- Detects RapidStealer payload
- Family: RapidStealer
  RapidStealer is an infostealer based on Electron.
  stealer rapid_stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  KitelGame.exe
- Size 191.9MB
- SHA256 41dddf17e5a798052a930b38a4b93475342859ffdaec808ba8aadb2e3e3f64b9
- MD5 1dff854a4b55ee6626823a6f2f637c65
- SHA1 fa5460fb2fd83f758a77f089068a1f635ec2dbec
- SHA512 0636f54c442a0b4c27997a1c8a7d5f6c13c861967059ddb5d56917a6dc0106ccd38b318eb4c2b6c499de15c4a18067b5e4881249dff3bce30d1fa813c29046d5
- SSDEEP 1572864:ihqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709xV:3OMMpBKvPTJJlfz
- TLSH
  T1E2A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2