Obsidium V1338 Obsidium Software

Hunt Hypothesis

This hypothesis targets the presence of Obsidium software, a known cryptocurrency wallet, which adversaries may deploy to stage stolen digital assets or facilitate off-ramping of funds. Proactively hunting for this specific version allows the SOC to identify potential financial theft or persistence mechanisms before the adversary completes the transfer of assets.

YARA Rule

rule Obsidium_V1338_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Obsidium Desktop Client Updates: The Obsidium application (a known desktop automation or RPA tool) performs self-updates or background syncs, causing the executable or associated DLLs to match the YARA signature.
  • Filter: Exclude processes where the parent process is Obsidium.exe or ObsidiumUpdater.exe and the file path resides within the standard installation directory (e.g., C:\Program Files\Obsidium\).
• Scheduled Maintenance Jobs: An enterprise scheduled task (e.g., via Task Scheduler or cron) runs a script that invokes Obsidium for nightly data extraction or report generation, triggering the detection on the spawned process.
  • Filter: Exclude events where the parent process is svchost.exe (specifically the Task Scheduler service) or TaskScheduler.exe, and the command line contains specific Obsidium task identifiers (e.g., --task=nightly_sync).
• Development and Testing Environments: Developers or QA engineers run Obsidium in local development containers or VMs to test integration workflows, often using debug builds or modified binaries that match the YARA rule.
  • Filter: Exclude hosts tagged with env=dev or env=qa in your CMDB or asset inventory, or exclude file paths containing \dev\, \test\, or \sandbox\.
• Third-Party Integration Plugins: A legitimate enterprise plugin (e.g., for Jira, ServiceNow, or Salesforce) bundles Obsidium components for workflow automation, causing the plugin’s helper process to trigger the rule.
  • Filter: Exclude processes where the parent process is a known enterprise application (e.g., java.exe, node.exe, or specific SaaS client executables) and the file path includes \plugins\ or \integrations\.
• Legacy Scripting Dependencies: Older internal scripts