Obsidium V1337 Obsidium Software

Hunt Hypothesis

This hypothesis targets the presence of Obsidium software, a known cryptocurrency wallet, which adversaries may deploy to facilitate digital asset theft or establish a foothold for financial exfiltration. Proactively hunting for this specific YARA signature allows the SOC team to identify potential insider threats or compromised endpoints where cryptocurrency tools are installed, enabling early intervention before funds are transferred.

YARA Rule

rule Obsidium_V1337_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Update via Scheduled Task: The Obsidium software (often associated with specific legacy or niche enterprise tools, such as certain versions of database management interfaces or proprietary middleware) is updated by a vendor-provided scheduled task (e.g., ObsidiumUpdater.exe) that runs under the SYSTEM account. This process may temporarily spawn child processes or modify its own binary hash, triggering the YARA rule if it matches the version-specific signature.

  • Filter/Exclusion: Exclude processes where the parent process is schtasks.exe or Task Scheduler service (svchost.exe with TaskScheduler argument) and the executable path resides in a known vendor directory (e.g., C:\Program Files\Obsidium\ or C:\Program Files (x86)\Obsidium\).

• Administrative Manual Installation/Repair: An IT administrator manually runs the Obsidium installer or repair utility (setup.exe or obsidium_repair.exe) from a network share or local admin PC to fix a corrupted installation. The installer may drop temporary files or execute a self-extracting archive that matches the YARA signature before the final installation completes.

  • Filter/Exclusion: Exclude events where the parent process is explorer.exe or cmd.exe/powershell.exe initiated by a user in the Domain Admins or IT_Support group, and the working directory is a temporary folder (%TEMP%) or a known software staging area.

• Antivirus/EDR Quarantine Scan: The endpoint protection agent (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) performs a deep scan or quarantine operation on the Obsidium executable. During this process, the EDR may create a shadow copy, rename the file to .quarantine, or execute a verification step that