MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SiriusRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff
SHA3-384 hash: 570f2f79cda0e04e5f9bb6369a668cea98d483a303a46e6e623e06867df7c1e73894bf5e35099ea2222eba574190fd7e
SHA1 hash: c5c75a065e0468dc272b42c97c692343bf13510a
MD5 hash: 258a1422bf0609365b836b758c9ce867
humanhash: whiskey-beer-music-mirror
File name:Pago entrante $980,465,87.PDF.js
Download: download sample
Signature SiriusRAT
Create hunting rule
File size:348'538 bytes
First seen:2026-04-30 06:32:20 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:gyNhfNBhHthrLnpeG044Nfi9c+7jV6CEsV4HCpZ/B7GIhtoDHlqaN3qLe+Vmv:vNNHthrLnp3044Nq9cGVPEsV4ipZJ7G5
Threatray 184 similar samples on MalwareBazaar
TLSH T11874EC202AFE500DB1B3AF556FF475A68A6FFA632E26905D1050034E4B73E41DDE273A
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika txt
Reporter lowmal3
Tags:js SiriusRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 conhost crypto encrypted masquerade overlay powershell repaired
Link:
https://www.filescan.io/uploads/69f2f77d7d31ad7bba4d1075/reports/1663d902-67d2-41df-a362-ee7a965bd522/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff
Verdict:
Malicious
File Type:
js
First seen:
2026-04-29T08:36:00Z UTC
Last seen:
2026-05-02T03:09:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Agent.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff/results?tab=lookup
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1906660
Signature
Contains functionality to hide user accounts
Contains functionality to start a terminal service
Deletes shadow drive data (may be related to ransomware)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Modifies the windows firewall
Sigma detected: Suspicious Parent Double Extension File Execution
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Tries to access browser extension known for cryptocurrency wallets
Uses an obfuscated file name to hide its real file extension (double extension)
Uses netsh to modify the Windows network and firewall settings
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Generic Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1906660 Sample: Pago entrante $980,465,87.PDF.js Startdate: 30/04/2026 Architecture: WINDOWS Score: 100 35 zagaseguros.com 2->35 43 Malicious sample detected (through community Yara rule) 2->43 45 Yara detected Generic Stealer 2->45 47 Yara detected Clipboard Hijacker 2->47 49 5 other signatures 2->49 11 wscript.exe 1 1 2->11         started        14 svchost.exe 1 1 2->14         started        signatures3 process4 dnsIp5 67 JScript performs obfuscated calls to suspicious functions 11->67 69 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->69 71 Suspicious execution chain found 11->71 73 WScript reads language and country specific registry keys (likely country aware script) 11->73 17 conhost.exe 11->17         started        41 127.0.0.1 unknown unknown 14->41 signatures6 process7 process8 19 powershell.exe 14 15 17->19         started        dnsIp9 37 zagaseguros.com 172.67.210.13, 443, 49681 CLOUDFLARENETUS United States 19->37 51 Contains functionality to start a terminal service 19->51 53 Contains functionality to hide user accounts 19->53 55 Found many strings related to Crypto-Wallets (likely being stolen) 19->55 57 4 other signatures 19->57 23 InstallUtil.exe 19->23         started        signatures10 process11 dnsIp12 39 77.83.39.174, 4449, 49682 DINET-ASRU Ukraine 23->39 59 Contains functionality to start a terminal service 23->59 61 Contains functionality to hide user accounts 23->61 63 Deletes shadow drive data (may be related to ransomware) 23->63 65 3 other signatures 23->65 27 netsh.exe 2 23->27         started        29 netsh.exe 2 23->29         started        signatures13 process14 process15 31 conhost.exe 27->31         started        33 conhost.exe 29->33         started       
Score:
65%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff/
Verdict:
Malicious
Threat:
Trojan.MSIL.Agent
Link:
https://tip.neiki.dev/file/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-29 15:33:34 UTC
File Type:
Text (JavaScript)
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2vzsgnzgvvxkjzbf2w7sz6agnjrt6m5xaps6wq2lh7d35367j37q._file
Verdict:
malicious
Label(s):
stubrunner
Create hunting rule
siriusrat
Create hunting rule
Similar samples:
0563f9e1d0fe8c2cf932f55fb8341ee86c1d1ee7d1be5d99f929db36d92dcf97
SiriusRAT
1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215
SiriusRAT
4d6c0d65d01270a5a816cd6db4bb69652375a178d2d8b9eb25b416f51bea09d7
SiriusRAT
53677cc49eec8b73ed8262ef82e09f43a38f75784a1efd915a3a3534e10c693e
SiriusRAT
71a0a7bb6a8601caf99e224573657e64186a4b05cd1005277a612f2f05e01890
SiriusRAT
7772251f9973041149d84c7bb096014b581be5e81948489c541f16576413e169
SiriusRAT
8b450c09dcd4cddff6ced02326719c500c953b087cffdf7f325639c2add8a738
SiriusRAT
9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7
SiriusRAT
c778eba8e5385b17a51bbef0e1b3c51db6dc485378c90cff1b9db7aad67c8349
SiriusRAT
error
SiriusRAT
+ 174 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion execution persistence privilege_escalation
Link:
https://tria.ge/reports/260430-hav6raft4r/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Suspicious use of SetThreadContext
Checks computer location settings
Badlisted process makes network request
Downloads MZ/PE file
Modifies Windows Firewall
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SiriusRAT

Java Script (JS) js d573233726ad6ea4e425d5bf2cf8066a633f33b703e5eb434b3fc7beefdf4eff

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments