siriusrat | 224b8131373b2cc009de87b7c93f78029aa8b31a50970d8b83d8827fb0e25466

General

Target
googlechrome.exe
Size 2.0MB
Sample260707-p9v4csav4z
SHA256 224b8131373b2cc009de87b7c93f78029aa8b31a50970d8b83d8827fb0e25466
MD5 757c74210214a743b14eb909a694c896
SHA1 18f36034adb19d44ddfd652e1befb49917349e3b
SHA512 ed07c3b1a11faa20d143f2bf25c9ad8c80d852a594bab1f9468528b7ed01b8814e04609c06d466a5f9537983b101627b92fd77799139e95a71a6e87f89bf20bd
SSDEEP 24576:W5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:Gno8haujVsPAB8KY2+Bz+2
TLSH
T1CAA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  googlechrome.exe
- Size 2.0MB
- SHA256 224b8131373b2cc009de87b7c93f78029aa8b31a50970d8b83d8827fb0e25466
- MD5 757c74210214a743b14eb909a694c896
- SHA1 18f36034adb19d44ddfd652e1befb49917349e3b
- SHA512 ed07c3b1a11faa20d143f2bf25c9ad8c80d852a594bab1f9468528b7ed01b8814e04609c06d466a5f9537983b101627b92fd77799139e95a71a6e87f89bf20bd
- SSDEEP 24576:W5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:Gno8haujVsPAB8KY2+Bz+2
- TLSH
  T1CAA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution siriusrat impact persistence privilege_escalation ransomware rat spyware stealer trojan
- Detects SiriusRAT
- Family: SiriusRAT
  SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
  rat siriusrat
- Windows security bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Drops startup file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1