Extracted

• • Target
    _3483b7680898f8691b352ba248dc962c3e7734e7da76f78dcd4a31e2a2342ea1.txt
  • Size 2.6MB
  • SHA256 3483b7680898f8691b352ba248dc962c3e7734e7da76f78dcd4a31e2a2342ea1
  • MD5 75757460119ac9a01665a0e268bab386
  • SHA1 eb2807792d9638986206622279ccb2f62c8a4331
  • SHA512 38f939d116d36231d6674bc941b544722455a297b33bfc6bdf0f5fe2894abacdca16c8907b44ea46d094e9070ddc12cee1326c2d5e7de5cadf3d06d07c29f776
  • SSDEEP 12288:pPly9JGCkCKvkS9/yx1xs8HbUQyUUU/UCUeUUUXUh5:QV7J
  • TLSH
    T1B8C5CA68CFA291509122EB169DE22161626F236737DB6D3C347F0FDC1B126F6513AB0E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionsiriusratpersistencerat

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2