MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SiriusRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33
SHA3-384 hash: 50bf826e665675064d849cc73cae38563bbc5a780271ca5521febcd0d2596fb71b67da24c21d3d37bd7a54354b99f095
SHA1 hash: 6119440a375b005aa4d0b353317c4e666eb86d60
MD5 hash: ad90591b2248a0b5a44cda8aa839e4f2
humanhash: papa-lemon-avocado-jig
File name:EFT Remittance Slip - SWIFT482847284994723.vbs
Download: download sample
Signature SiriusRAT
Create hunting rule
File size:454'934 bytes
First seen:2026-06-22 15:14:51 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:SWn6kWIDX74F9DoY8+j4nSpieUiiLyovijeuG/4NEMr:dD0B2NGN5
Threatray 56 similar samples on MalwareBazaar
TLSH T1BEA40C38ADEA402B71FBEE598AD478D6E95FB663370E541D109303CA4713942EDC263E
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter abuse_ch
Tags:SiriusRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71573/
Detection(s):
SecuriteInfo.com.VBS.Agent-107.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3951e486bc95245bf8b265
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 base64 crypto obfuscated powershell zero-day
Link:
https://www.filescan.io/uploads/6a39524d9de4cf364c10c05d/reports/4d3a3ee7-d680-42c7-850b-04fc44ed062a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33
Verdict:
Malicious
File Type:
vbs
First seen:
2026-06-22T05:38:00Z UTC
Last seen:
2026-06-24T11:56:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1932115
Signature
Antivirus detection for URL or domain
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Early bird code injection technique detected
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Powershell scriptblock execution from environment variable
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to access browser extension known for cryptocurrency wallets
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1932115 Sample: EFT Remittance Slip - SWIFT... Startdate: 22/06/2026 Architecture: WINDOWS Score: 100 41 www.controliumbt.com 2->41 43 server.activeworkshops.com 2->43 45 2 other IPs or domains 2->45 61 Antivirus detection for URL or domain 2->61 63 Sigma detected: WScript or CScript Dropper 2->63 65 Joe Sandbox ML detected suspicious sample 2->65 10 wscript.exe 1 2->10         started        13 svchost.exe 1 1 2->13         started        signatures3 process4 dnsIp5 75 VBScript performs obfuscated calls to suspicious functions 10->75 77 Suspicious powershell command line found 10->77 79 Wscript starts Powershell (via cmd or directly) 10->79 81 4 other signatures 10->81 16 powershell.exe 15 18 10->16         started        51 127.0.0.1 unknown unknown 13->51 signatures6 process7 dnsIp8 39 controliumbt.com 185.181.252.118, 443, 49690 WHG-USE1GB United States 16->39 53 Early bird code injection technique detected 16->53 55 Creates an undocumented autostart registry key 16->55 57 Writes to foreign memory regions 16->57 59 2 other signatures 16->59 20 svchost.exe 12 16->20         started        25 conhost.exe 16->25         started        signatures9 process10 dnsIp11 47 ip-api.com 208.95.112.1, 49691, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 20->47 49 server.activeworkshops.com 5.101.81.131, 16614, 49692 AS-GLOBALTELEHOST-GTHostUS France 20->49 35 C:\Users\user\AppData\...\places.sqlite-shm, data 20->35 dropped 37 C:\Users\user\AppData\...\cookies.sqlite-shm, data 20->37 dropped 67 Tries to harvest and steal browser information (history, passwords, etc) 20->67 69 Writes to foreign memory regions 20->69 71 Tries to access browser extension known for cryptocurrency wallets 20->71 73 3 other signatures 20->73 27 msedge.exe 3 20->27         started        29 chrome.exe 1 20->29         started        file12 signatures13 process14 process15 31 msedge.exe 27->31         started        33 chrome.exe 29->33         started       
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-06-22 09:24:42 UTC
File Type:
Text (VBS)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kcoxnfirgntqmlrj2qjli32sxendnr4lgdti5us54jewlwzrizq._file
Verdict:
malicious
Label(s):
unc_stealer_011
Create hunting rule
Similar samples:
1d2d9b8e18d2fee71d835391e9167d3ef26309279d4a186a010556a79004251b
SiriusRAT
220a9b6ae51dcfa91fc56516178c62bca535ef8f1db792aa863d442066f50691
SiriusRAT
443ab50f1e37a066234f533d168d1215f74242a187bc7ee02c0133661626940b
SiriusRAT
5a31b27b8a41ba3387f060f9ebe9353e1fbab6b23e6b8f9ba8fb364c3c8ed5ba
SiriusRAT
5f28446e9b5e1b6b8320defead4656909251cece99359838f1f094f6bd593944
SiriusRAT
77f9274bc3cd9bfbe2df5505168207168d672f57966416ac71b4021f78902f5a
SiriusRAT
7b364e0b8f5ab0857360f82b4912a18b79156c1761301aea666b2c02417b7969
SiriusRAT
9b0a014f838f441de73f5cb7537a70f7f5a0b2b00159597ef5768beecfdd4403
SiriusRAT
d451229055d8e537fd17aafc7babd3170299b1d84da5e60acb0103a0307b3035
SiriusRAT
error
SiriusRAT
fb2826b4e02393e9656ef4c7f3718c2d4a48c6b805cb5b3b9a5e192df1e0af20
SiriusRAT
+ 46 additional samples on MalwareBazaar
Result
Malware family:
siriusrat
Create hunting rule
Score:
  10/10
Tags:
family:siriusrat collection discovery execution persistence rat
Link:
https://tria.ge/reports/260622-snhgxsdy9y/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Time Discovery
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detects SiriusRAT
Family: SiriusRAT
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
server.activeworkshops.com:16614
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/71573/

Comments