Extracted

• • Target
    Quotation_Supplier_Input_Needed#0069493.js
  • Size 1.5MB
  • SHA256 639d39a39495c4df56f46bc04aa82ba5631560b4b8d840b7a8d5e0e6c156876a
  • MD5 7427e3e9aed55255da5565a9e856f34c
  • SHA1 8499c9783c250cacb17bfebfd1bf2affe889b2ac
  • SHA512 d4cb22b5f977e9f15f68123da44ee8b03b3b1934c8250846bb7b057a89ff88d2dc6823bab589eceb6d6f718800b56cfbfb1a554e2171447be9d5123295f415ec
  • SSDEEP 3072:YIvMqCO1X9cYy1sRrZAKxpRljN3TKz4VUpIHQId8jhbTp+yXIVyTvsy040t:fXiKLTyIHUhgyYWm
  • TLSH
    T19375D4A4434A312CF7E1395310240E6D4F9335A7A528BE4C6AA8578F9E37E8ACF4571F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionsiriusratpersistencerat

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2