Full Report
Learn about the information stealing browser extension Rilide, its delivery methods, and intrusion chain.
Analysis Summary
# Tool/Technique: Rilide Browser Extension
## Overview
Rilide is an information-stealing malware disguised as a browser extension that targets Chromium-based browsers (like Google Chrome and Microsoft Edge). Its primary function is to exfiltrate sensitive information by taking screenshots, logging input, and collecting credentials for services, especially cryptocurrency wallets.
## Technical Details
- Type: Malware family (Information Stealing Browser Extension)
- Platform: Chromium-based Browsers (Google Chrome, Microsoft Edge)
- Capabilities: Information stealing, credential harvesting, screenshot capturing, cryptocurrency wallet credential collection.
- First Seen: April 2023
## MITRE ATT&CK Mapping
Since the article primarily details delivery and initial execution rather than the specific post-compromise actions of the extension itself (beyond stealing), the mapping focuses on delivery and execution phases based on the observed intrusion chains:
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (via PowerPoint lure)
- T1566.002 - Spearphishing Link (via phishing websites/Twitter lure)
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell (used in the final observed dropper stage)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Use of Base64 encoding and XOR operations in loaders)
## Functionality
### Core Capabilities
- Impersonates legitimate extensions (e.g., Google Drive, Palo Alto).
- Steals passwords and user credentials.
- Collects cryptocurrency wallet credentials.
- Captures information via screenshots.
- Updated to comply with Chrome Extension Manifest V3 requirements.
### Advanced Features
- **Delivery via Multiple Vectors:** Utilizes malicious advertisements, phishing pages, PowerPoint lures, and social media (Twitter) redirects.
- **Complex Loader:** Versions analyzed use sophisticated PowerShell scripts featuring multi-layered obfuscation (Base64 encoding, character manipulation, and XOR operations) to fetch and install the malicious extension.
- **Manifest V3 Compliance:** Newer variants adapted to the stricter security model of Manifest V3, moving logic entirely inside the packaged extension rather than relying on remote loading (`executeScript()`, `eval()`, and remote file loading are removed).
## Indicators of Compromise
*Note: Only observable artifacts for the delivery stage PowerShell loader are fully detailed in the text.*
- File Hashes:
- MD5: `650052f23efde0ed4460b760134db8c6`
- SHA-1: `286574e458cddb32032ba4935d7f8e2716cfcf2c`
- SHA-256: `76afc4a7ef10d760c3fa42458e8f133f1ed4d76071ab6f4207037f64a4bffab7`
- File Names: `.ps1` (PowerShell script)
- Registry Keys: [Not specified in the context]
- Network Indicators:
- Historical C2 Domain (registered Oct 5, 2024): `tcl-black[.]com` (defanged)
- Behavioral Indicators:
- Execution of a PowerShell script that launches a hidden instance (`-noninteractive` or similar implied when "without displaying the PowerShell window").
- Heavy reliance on Base64 decoding, character manipulation, and XOR operations within obfuscated scripts.
- Use of `WebClient` for downloading payloads.
## Associated Threat Actors
- [Not explicitly named in the provided context, though researchers like Trustwave have grouped observed campaigns.]
## Detection Methods
- Signature-based detection: Using the provided file hashes against threat intelligence feeds.
- Behavioral detection: Monitoring for obfuscated PowerShell scripts that employ chained decoding techniques (Base64 -> XOR -> Decimal to URI decoding) and attempt network connections for secondary payloads.
- YARA rules: [Not available in the context]
## Mitigation Strategies
- **User Training:** Educate users to be wary of phishing links, particularly those originating from malicious advertisements or social media redirects.
- **Hardening Browsers:** Use security features provided by Chromium browsers.
- **Script Control:** Limit or monitor the execution of obfuscated PowerShell scripts, especially if they launch hidden instances.
- **Extension Management:** Implement strict controls over which extensions can be installed, ideally restricting installations to verified enterprise stores.
## Related Tools/Techniques
- Browser extension-based stealers (general category)
- Other information stealers leveraging PowerShell loaders.