Fake GitHub repositories that impersonate major software companies are distributing a new malware strain called Rapuncel. The campaign also uses a Microsoft-signed driver to shut down antivirus and endpoint security products.
Fake GitHub Repositories Target Software Searches
LastPass and Delphos Labs discovered the ongoing malware campaign. According to their research, the attackers impersonate LastPass and at least 39 other companies.
The attack begins when users search online for LastPass Authenticator or another popular software product. Search engine optimisation helps the fraudulent GitHub repositories appear prominently in the results.
These pages closely resemble legitimate software repositories. However, their download buttons send visitors through several redirects before reaching attacker-controlled servers.
The servers then provide ZIP archives that can reach 148MB. Attackers inflate the file size to make automated security scanning more difficult.
Legitimate Microsoft Tool Loads Malicious Code
Each archive contains a copy of Microsoft’s legitimate Visual Studio CoreCLR Debugger. The attackers rename the program as “vsdbg.exe” and configure it to load a malicious DLL called “vsdbg.dll.”
This DLL sideloading method allows trusted software to launch harmful code. As a result, the installer can deploy both the Rapuncel infostealer and a dangerous kernel driver.
The driver uses the original filename “Alinubx.sys.” However, the campaign disguises it as an NVIDIA component named “nvfsflt64.sys.”
It also registers the driver as a Windows service called “NvFsFilter.” This disguise may help the malicious component appear legitimate during a basic inspection.
Signed Driver Disables 145 Security Products
The kernel driver contains a hardcoded list of 145 antivirus and endpoint detection and response processes. It attempts to terminate each matching process on an infected computer.
Moreover, the driver opens targeted processes as kernel code. This technique bypasses the normal security checks that Windows applies to requests from user-mode programs.
Consequently, the driver can defeat Protected Process Light. Many security products rely on this Windows protection to prevent administrators or malicious programs from shutting them down.
The driver also carries a valid signature from Microsoft’s Windows Hardware Compatibility Publisher chain. Furthermore, Microsoft’s vulnerable driver blocklist does not currently include it.
Researchers identified several additional capabilities inside the driver. These include file and registry hiding, DLL injection and process interception.
The driver can also manipulate network traffic, redirect ports and interfere with other drivers. However, researchers found no evidence that the current campaign activates these features.
Rapuncel Infostealer Collects Sensitive Data
After the driver disables security software, the Rapuncel infostealer begins collecting information from the compromised computer.
The malware targets stored credentials across 25 web browsers. It also searches 30 cryptocurrency wallets for valuable data.
In addition, Rapuncel steals session credentials from Discord, Steam and Telegram. It also collects information from Windows Credential Manager.
The malware searches for documents with filenames that contain terms such as “password,” “seed,” “wallet” or “recovery.” These files may contain login details, cryptocurrency recovery phrases or other sensitive information.
Rapuncel also captures screenshots from every connected monitor. Finally, it gathers detailed information about the infected system and its configuration.
Malware Bypasses Browser Encryption
Google introduced app-bound encryption to protect sensitive data in Chrome and related browsers. Microsoft Edge also uses this security mechanism.
However, Rapuncel attempts to bypass the protection by injecting a helper DLL into the browser. It then invokes its own Elevation Service to gain access to the protected information.
After collecting the data, the malware compresses it into an archive. It then uploads the archive to an external IP address through an HTTP-formatted request sent over raw TCP.
Windows Service Maintains Persistence
Rapuncel creates a Windows service to maintain access after a system reboot. Therefore, restarting the computer does not remove the infection.
The malware also coordinates its components during startup. First, the malicious driver targets any security tools that become active again. Rapuncel then launches after the driver has cleared the way.
This persistence mechanism allows the malware to continue stealing data while repeatedly suppressing defensive software.
LastPass and Delphos Labs believe, with moderate confidence, that Rapuncel represents a variant of the BoryptGrab malware. Their analysis also linked its loader to the Cruciferra PUROSANGUE crypter.
Users Should Download Software From Official Sources
Users can reduce their exposure by downloading applications only from official company websites. They should treat unfamiliar GitHub repositories with caution, even when those pages appear professional.
Promoted search results can also lead to malicious download pages. Therefore, users should verify the website address before downloading or installing any program.
Security teams should also monitor systems for the malicious driver, its associated service and unexpected instances of the Visual Studio debugger. Early detection remains especially important because the driver can disable many widely used security products.
0 responses to “Fake GitHub Repositories Spread Rapuncel Infostealer”