Extracted

• • Target
    Purchase order for BDPL 01.06.2026_pdf.js
  • Size 1.9MB
  • SHA256 fe7c49ac0611318a243746cb106b3a6983612338e055706c76b4aa386945b3ae
  • MD5 1ccc8453b7a08484e56e1754abe7cdc4
  • SHA1 6c0d15f4b7e6942dcb6738303d553a4f6fa3cbb0
  • SHA512 41a8ff297086d6e64f89e7ebd7b8cf7d0d0921b3265cb0903da8c0477e4b2efa46a2af053893985caeafb0fd1e3587a8de9f82aa0b801c0b5ff19816d746af14
  • SSDEEP 6144:56fEKOqw0PyhFfM2g5NHMwA+xVA2RQp6Dwdi7vBjQDRw4uh0oxKrSdFHCgZ:pTdg5+8BUd+Dh0J2Sy
  • TLSH
    T1C8952724BF7E1785E0AC62A01DC8C6A3759EC7A997EB513C54744ECC137A80853FAB78
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionsiriusratpersistenceratadwareransomwarespyware

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2