Overview

overview

10

Static

static

1

TENDER-200...11.vbs

windows10-2004-x64

10

TENDER-200...11.vbs

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TENDER-20005953911.vbs
  • Size 37KB
  • Sample260724-cvdvbaeb77
  • SHA256 642905ce09772b7ee37efac563f1d14581b2d677a738aa8f44244659d331f921
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
siriusratcollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrattrojan

Malware Config

Targets

    • Target
      TENDER-20005953911.vbs
    • Size 37KB
    • SHA256 642905ce09772b7ee37efac563f1d14581b2d677a738aa8f44244659d331f921
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondefense_evasiondiscoveryexecutionsiriusratpersistenceprivilege_escalationrattrojan

    • Detects SiriusRAT

    • Family: SiriusRAT

      SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

      ratsiriusrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Windows security bypass

      defense_evasiontrojan

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Executes a VBScript file via the Windows Script Host.

      execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks