General
- Target 04082026_1256_04082026_NEW PO & SAMPLE DETAILS.zip
- Size 2.7MB
- Sample260804-p6cslsfj71
- SHA256 ad969264ff83803599b461ffb669fe7a5b757734917f26fac8790303376f2fb2
Score
10/10
Malware Config
Targets
-
- Target NEW PO & SAMPLE DETAILS.exe
- Size 2.7MB
- SHA256 13367ed6c45119783c7eccc3db9b7a9095a4d662d9f5e7bc1ae1d195958ab1e2
Score10/10-
Detects SiriusRAT
-
Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Suspicious use of SetThreadContext