Rapuncel Infostealer Oversized ZIP Delivery with Junk DLL Padding

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects the delivery of Rapuncel infostealer via abnormally large ZIP archives that incorporate binary padding with junk DLL files (such as TitanStorage.dll or ProManager.dll). This technique is used to evade security scanners that have file size limitations. The rule tracks specific campaign filenames and junk file markers.