siriusrat | 4a3272aec9b51533b7e79d7096ddb2198065c5258dd1e15e51603697043e0d11

General

Target
2026-07-23_ff85309dbd4454ac14c934109af369b5_glassworm_icedid_luca-stealer_njrat
Size 2.0MB
Sample260723-3nxxqaxtbw
SHA256 4a3272aec9b51533b7e79d7096ddb2198065c5258dd1e15e51603697043e0d11
MD5 ff85309dbd4454ac14c934109af369b5
SHA1 5f414e755951f2ac969880f0e71837f034e87e6e
SHA512 47daa3631b8912691b27879d647512944f781235d6dcd2b15344af4ec3b88bba138a2c8c24800b476fb65dc3e5f58396f8d4cbd2a8d610b929d2c219af9cc141
SSDEEP 24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2
TLSH
T1DDA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-23_ff85309dbd4454ac14c934109af369b5_glassworm_icedid_luca-stealer_njrat
- Size 2.0MB
- SHA256 4a3272aec9b51533b7e79d7096ddb2198065c5258dd1e15e51603697043e0d11
- MD5 ff85309dbd4454ac14c934109af369b5
- SHA1 5f414e755951f2ac969880f0e71837f034e87e6e
- SHA512 47daa3631b8912691b27879d647512944f781235d6dcd2b15344af4ec3b88bba138a2c8c24800b476fb65dc3e5f58396f8d4cbd2a8d610b929d2c219af9cc141
- SSDEEP 24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2
- TLSH
  T1DDA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution siriusrat persistence privilege_escalation rat spyware stealer trojan
- Detects SiriusRAT
- Family: SiriusRAT
  SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
  rat siriusrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Windows security bypass
  defense_evasion trojan
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects command variations typically used by ransomware
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many Password Manager software clients. Observed in infostealers
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2