Extracted

• • Target
    RFQ-SCM04429866,PDF.PNG
  • Size 4.8MB
  • SHA256 df24016db1b73a029d08feada57fcffd4e1ef0e03dfbca0813a0f3ea2a044a1c
  • MD5 467670767bcd1c24dfe10a8f14e9738b
  • SHA1 08decb440bf2b4e95ce19cadaf226516a281041b
  • SHA512 6216318b8a17626c492b83d571fc66fcc3eb8ea04db39b20d6bff7c8eaa7128ed006ff67034c5870f7f1c038078ff371c2d30d673a0efd854e2d664ca60a3c4a
  • SSDEEP 3072:+PU7IrHVow8yDO1DHUFakwSa9fWQ5Ocg5ergFUr1B0GCcrphNiFNMqUxq4fR8G4x:I
  • TLSH
    T122364EA46114452E14EEDB429E7BFEC5D58B00CD2BA8556C520AFD19BB870EA30F7BF0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionsiriusratxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Detects SiriusRAT

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Windows security bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2