Extracted

• • Target
    Invoices_Records_confirmation_draft_review_06232026_print.vbs
  • Size 94KB
  • SHA256 bf90c692a297eb3237ec700f2660e230cf2a6c3d6f9ff8154ce6051c0b93ed0a
  • MD5 29e33d99848524c1de72ca8cae00e36f
  • SHA1 c28c03751a1152562f569ba3e9f90a46f02e422a
  • SHA512 beb801f217406a2397ebbe7d472ed7714d94816aa8771a01b32208151b668335b4c702eefe5dda53fd56a7c5b235579aba354ff5120246e99bac4c45cdd92f25
  • SSDEEP 1536:AtA7gc5tqnFOQKvlmffNbOGxSG9p01xhZZ6cl0KrAJU5gzd:AO7gc54O1It9xSG9p0HTZ6g0KsU5gB
  • TLSH
    T173934A31CE64079A0E471BF9FC961A61C9BCCA1A053210F4FEEA170D51069ACF7BE66D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverysiriusratpersistenceprivilege_escalationrat

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2