Extracted

• • Target
    _d41252ddc4fab7295681019cfb2f1c1e899e2f480c306bfad78b24c38165a807.exe
  • Size 3.6MB
  • SHA256 d41252ddc4fab7295681019cfb2f1c1e899e2f480c306bfad78b24c38165a807
  • MD5 286ab1c862a170f4ccdba9ee6b870445
  • SHA1 a6dbc09d360b0cc7bb5b45e015e191aa4528b1fc
  • SHA512 28fb0a36ccd6314df16463155c94b5904dded2827d7ec467f8f115a1b9ad6c439f8a1f0548982c7b18030f3bfc7c5610a47b28d41c8f45fac356d5fd890707f5
  • SSDEEP 98304:lvTbTo9Ow7UbGNJoH6S7QqL8iyhn8iYcLGLZI1raNk2gBLCSqL0GIB1Jpzx84lPv:lbbM/UbGNJoH6S7QqL8iyJgcLGLZI1rF
  • TLSH
    T15E06CF06BC9524B9D5B6A2B148B291E0B731F85E0F2217C32F15A7B92F773D40EB5398
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverysiriusratpersistenceprivilege_escalationratspywarestealer

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2