Date: 10/28/2026
Severity: High
Summary
The Threat Response Team investigated a suspicious alert involving an unexpectedly executed PDF, uncovering a multistage campaign delivering a previously undocumented Sirius Backdoor variant. The attack began with a phishing email containing a ZIP archive with a PDF that used malicious /OpenAction and /Launch objects to trigger a Base64-encoded PowerShell command. Execution required user interaction, as victims had to approve a security prompt displayed by the PDF reader. The PowerShell stager decrypted and loaded a .NET assembly directly into memory, reducing the need to write files to disk. The malware then used process hollowing to inject its code into legitimate Windows processes, including msbuild.exe and svchost.exe, helping it hide its activity.
Indicators of Compromise (IOC) List
Domains/URLs | https://dubaitechnicalservice.ae/prood/zeus.dat |
IP Address | 185.114.206.45 |
Hash | 3cc5147d1dbe295c63da958afadac6c6
87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51
6ffcf5f7aa4b3b75b06bd7a7f49366a8
7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105
39993389e1e95ebbd55aa54058cf7b52
6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4
64a9940fc78de8a895d968a4092ed10b
899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05
62A458EB260E7AA26092DBDF9C2D8ED4
eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c
e8b080c276519547e95930ab15028adb
d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://dubaitechnicalservice.ae/prood/zeus.dat" or url like "https://dubaitechnicalservice.ae/prood/zeus.dat" or siteurl like "https://dubaitechnicalservice.ae/prood/zeus.dat" |
Detection Query 2 : | dstipaddress IN ("185.114.206.45") or srcipaddress IN ("185.114.206.45") |
Detection Query 3 : | md5hash IN ("6ffcf5f7aa4b3b75b06bd7a7f49366a8","39993389e1e95ebbd55aa54058cf7b52","64a9940fc78de8a895d968a4092ed10b","e8b080c276519547e95930ab15028adb","3cc5147d1dbe295c63da958afadac6c6","62A458EB260E7AA26092DBDF9C2D8ED4")
|
Detection Query 4 : | sha256hash IN ("d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee","6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4","899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05","7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105","eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c","87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51")
|
Reference
Sirius Backdoor Deployment