🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SiriusRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89
SHA3-384 hash: 6e4d5f6049e6ecfa6a75fd1cf350470e98576978358fbfa197855ae7e3ae43d234c7ac943f46c78a07eb6797c513de58
SHA1 hash: 25b8a4f25cb77d181399df336b3e19c2b5073301
MD5 hash: fa56dbddeeb7f8f00e079d96aaf53304
humanhash: idaho-purple-hamper-carbon
File name:Proforma-Rechnung & Zahlungsavis für PI26082701.exe
Download: download sample
Signature SiriusRAT
Create hunting rule
File size:2'641'920 bytes
First seen:2026-10-01 12:02:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:F572oSL3A5lyoPVWbYILB/8dnfYME5q/RmCJKMo3EnP3ny:F572oSLN0VWbdwnQMSqZjKZMP3y
TLSH T155C52351B3A9DB52DDB217F80FB5E27063B62E0DA820D20A8ED57DD73532F141DA8623
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter lowmal3
Tags:exe SiriusRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-01 12:46:23 UTC
Tags:
ip-check evasion
Link:
https://app.any.run/tasks/204a65c2-c257-44aa-94d3-7038ae535f87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90043/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acea205350c7ee8cc153404
Tags:
virus cupi hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process from a recently created file
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6abe4c0714898c670bc2572c/reports/0c692f57-7707-4c4a-a2ea-18cab95d6b71/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-01T05:29:00Z UTC
Last seen:
2026-10-03T10:30:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2c510104-f9de-4901-b297-81163be8a479
Gathering data
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.21 Win 64 Exe x64
Link:
https://app.malva.re/file/fa56dbddeeb7f8f00e079d96aaf53304
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-10-01 08:18:29 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
4
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5hpoofbi3kpi4vbncgipl74k7dewc3zsindgheosjq6e7x4roeq._file
Result
Malware family:
siriusrat
Create hunting rule
Score:
  10/10
Tags:
family:siriusrat discovery rat
Link:
https://tria.ge/reports/261001-n75pcavygz/
Behaviour
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Looks up external IP address via web service
Executes dropped EXE
Detects SiriusRAT
Family: SiriusRAT
Malware Config
C2 Extraction:
solex.dns.army:8866
Unpacked files
SH256 hash:
274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89
MD5 hash:
fa56dbddeeb7f8f00e079d96aaf53304
SHA1 hash:
25b8a4f25cb77d181399df336b3e19c2b5073301
Link:
https://www.unpac.me/results/e474d834-1d27-43e5-8cc6-2e68e9401094/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/90043/

Comments