General
- Target af3940898cdea9a7e0f89278dc91ed0dac8534f77b59b3e0e6ae2c1ecd1fb6c1
- Size 2.8MB
- Sample260825-qpqhtasgpg
- SHA256 af3940898cdea9a7e0f89278dc91ed0dac8534f77b59b3e0e6ae2c1ecd1fb6c1
Score
10/10
Malware Config
Targets
-
- Target payload/WindowsUpdate.exe
- Size 2.8MB
- SHA256 dc45f3627ce8ad1276538ef7719a4c394a1b1835ee00739e6d94a783cca672f0
Score10/10-
Detects SiriusRAT
-
Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1