Rapuncel Stealer Staging Artifacts Written to Temp Output Folder

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

Detects the creation of specific staging files and directories associated with the Rapuncel infostealer (e.g., UserInformation.txt, installed_applications.txt, sends.log, browser_decryption.log, or the Filegraber directory) within Windows temporary storage paths. This activity typically occurs following the unauthorized collection of sensitive data such as credentials, digital wallet information, and messenger session data.