General
- Target 2adaacfd996d2bf5dec1d5eb9f75e6039bf1f2feeaa030d99b67f8c0fac1fc95
- Size 2.7MB
- Sample260817-dclymssvhy
- SHA256 2adaacfd996d2bf5dec1d5eb9f75e6039bf1f2feeaa030d99b67f8c0fac1fc95
Score
10/10
Malware Config
Targets
-
- Target SAMPLE PICTURE DRAWING.exe
- Size 2.8MB
- SHA256 d89ba6b6e40853434c11a8125a40e70f73c0457768777a95f487e8b233f6cdc2
Score10/10-
Detects SiriusRAT
-
Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext