SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft
Do Son 
A reseller named GhostKernel is observed to be active on both underground forums and Telegram.
TL;DR
Group-IB researchers analyzed more than 280 samples of the Windows SiriusQT RAT, a commercial malware family sold on dark web forums since April 2026. Offered for $500 by a reseller named GhostKernel and widely shared in cracked builds, the SiriusQT RAT merges Hidden Virtual Network Computing with a credential stealer. Furthermore, the implant uses six persistence techniques and a custom stream cipher to control infected Windows hosts.
Delivery and Attribution
In April 2026, sellers began promoting SiriusQT v1.0.5 across underground forums and Telegram channels as a Malware-as-a-Service product priced at $500 for a lifetime license. Soon after, secondary actors leaked a Python key generator and cracked server builds bearing the window title “Sirius Cracked by Claude” on dark web forums and GitHub. Across 146 extracted 32-byte license tokens, Group-IB identified 110 leaked keys alongside at least 30 paying buyers using 14-day, 30-day, 45-day, 90-day, 99-day, and lifetime plans. In the field, attackers deployed the malware as a final-stage payload behind the UpCrypter loader, an infection chain also documented by Fortinet.
Confirmed Versus Suspected Attribution
Confirmed attribution connects the commercial sales and Telegram support channels directly to a reseller tracked as GhostKernel, who previously promoted the BTMob v4.0 Android banking trojan in February 2026. However, suspected attribution applies to the tool’s creator. According to the Group-IB research report, “Despite “Amonus” being referenced as the alleged author of SiriusQT RAT in the about form of the RAT server-side component, no direct evidence linking “Amonus” to the development, promotion, or distribution of the tool was found.”
Public malware submissions revealed over 280 client builds, with the United Kingdom, France, Germany, and the Netherlands accounting for more than 50 percent of observed locations. Additionally, decrypted offline client databases and campaign tags revealed victims and targets in Spain, Italy, Russia, the United States, Mexico, the United Arab Emirates, China, and Taiwan.
Infection Chain
The server builder compiles payloads in three formats: a native x64 C++ executable and packed 32-bit or 64-bit .NET loaders. When a .NET loader runs, it reads its own file overlay, decodes the payload with a four-byte XOR key, and launches the native Windows SiriusQT RAT directly in memory. Operators can also configure the builder to block execution on virtual machines or systems located in Commonwealth of Independent States countries.
Six Persistence Methods and Process Injection
Next, the implant reads its settings from a resource named Caffee_Config or a 4,096-byte fallback blob and creates a random mutex. Depending on builder flags, the malware establishes persistence through six methods: a current-user Registry Run key, a scheduled task, a Startup folder shortcut, a UserInitMprLogonScript batch file, an administrator Session Manager BootExecute entry, or by poisoning the default Windows user profile hive to infect future accounts.
Afterward, the binary walks the Process Environment Block to resolve Windows APIs using a 32-bit FNV-1 hash algorithm. It also monitors network interface changes so it can reconnect automatically if the local IP address drops. For secondary payloads, the SiriusQT RAT supports process hollowing, early-bird asynchronous procedure call injection, and remote thread creation.
Command-and-Control and Data-Exfiltration Behavior
When the operator starts a Hidden VNC session, the server pushes a reflective 64-bit DLL named HVNCInjection.x64.dll to the victim host. This module resolves APIs via ROR13 hashes and includes MinHook code to redirect file-system paths, although dynamic testing showed the path hooks remained inactive. More importantly, the client clones the victim’s Chromium browser profile into a separate folder and launches a hidden browser instance with sandboxing and GPU rendering disabled. Changes on the hidden screen return to the operator over a 64-by-64 pixel tile grid.
Credential Recovery and Custom C2 Encryption
Beyond hidden desktop control, the Recovery panel lets operators select from over 100 credential targets using a 16-byte bitmask. The Windows SiriusQT RAT decrypts AES-GCM passwords and tokens from Chromium browsers, cryptocurrency wallets, VPNs, FTP clients, and messaging apps. For Discord, the client even sends stolen tokens to Discord’s API to verify account validity before exfiltration. Meanwhile, a low-level keyboard hook and a clipboard monitor capture keystrokes and wallet addresses when targeted window titles appear.
All traffic between the client and server uses a four-byte cleartext length header followed by an encrypted body. As the researchers noted, “SiriusQT does not appear to use a standard encryption algorithm such as ChaCha20 or Salsa20 for its network traffic, even though the binary contains the string “expand 32-byte k”.” Instead, the malware mixes a 32-byte key and a 64-bit packet counter using MurmurHash3 finalizer constants to generate a 16-byte XOR keystream. Notably, several campaigns hosted their command servers on Google Cloud IP ranges or servers previously linked to RedLine Stealer, NetWire, and Remcos.
Defense and Detection Guidance
Security teams can detect the SiriusQT RAT by scanning executables and memory dumps for the Caffee_Config resource name or the SIRIUS_STUB_CONFIG marker string. Defenders should also monitor endpoint telemetry for Chromium browsers launched with custom user-data directories, disabled sandboxes, and an inline “Welcome to HVNC !” page. Furthermore, administrators should audit the Default User NTUSER.DAT registry hive, UserInitMprLogonScript environment variables, and Session Manager BootExecute keys for unauthorized entries labeled Windows Update. If an infection is confirmed, responders must isolate the host, revoke active browser and Discord sessions, and rotate all stored passwords and cryptocurrency keys.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
