siriusrat | 8972d534b5a1a049e0d5d069eb89946a6d46a342049f76a064b8f07a96861bbb

General

Target
RFQ-SCM04429866,PDF.vbs
Size 4.6MB
Sample260922-sn9leaxfmd
SHA256 8972d534b5a1a049e0d5d069eb89946a6d46a342049f76a064b8f07a96861bbb
MD5 94810b637a367283244e4a13d0d5c249
SHA1 518e39a3a8ebb033b641eed589dd35f561a759ab
SHA512 e12daa1e53b80529c3878487c7e6eca7357c64f94f2be2508dc2803f958901bb431d3931392e24662aff1972be6abfa20f46b30fff3e313196a0f2f2635d1c77
SSDEEP 1536:fmLWRgNVDprfVOsntG7EQte0owtfUeXSjlLWZaFe2OK+H3BaByham6YPtMMrLaI8:2
TLSH
T1C0264EF68340E813E0A83917A4CDFC8959486CD1A732A5E705609F687B06BD7BBB13F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RFQ-SCM04429866,PDF.vbs
- Size 4.6MB
- SHA256 8972d534b5a1a049e0d5d069eb89946a6d46a342049f76a064b8f07a96861bbb
- MD5 94810b637a367283244e4a13d0d5c249
- SHA1 518e39a3a8ebb033b641eed589dd35f561a759ab
- SHA512 e12daa1e53b80529c3878487c7e6eca7357c64f94f2be2508dc2803f958901bb431d3931392e24662aff1972be6abfa20f46b30fff3e313196a0f2f2635d1c77
- SSDEEP 1536:fmLWRgNVDprfVOsntG7EQte0owtfUeXSjlLWZaFe2OK+H3BaByham6YPtMMrLaI8:2
- TLSH
  T1C0264EF68340E813E0A83917A4CDFC8959486CD1A732A5E705609F687B06BD7BBB13F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution discovery siriusrat xworm persistence privilege_escalation rat trojan
- Detect Xworm Payload
- Detects SiriusRAT
- Family: SiriusRAT
  SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
  rat siriusrat
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2