Overview

overview

10

Static

static

10

001238599.exe

windows7-x64

10

001238599.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    001238599.exe

  • Size

    4.2MB

  • MD5

    1b2e46873d9b3e346c21492a1f1c612a

  • SHA1

    5fbcd31622ccd101b3b1f7184f5133f7fa3a2766

  • SHA256

    421a3a05b2075995ec1a5e0fe9307f88c7faeec3d28052d5071ce2e895afadec

  • SHA512

    04ef2542de7a07b3fc95b61db1755b5bb052941fcf56bde660349135958b12dc6447f82cc2251314ba6de9a7622c396c556dc54b35593a38973a67f0e2d7d730

  • SSDEEP

    98304:MpX2LQT116ToppwMgVypSb2TgTUKo9JCm:w2A13ppwMgVypSQJC

Score
10/10
новый тегorcus

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

128.59.46.185:50272

Mutex

sudo_8n66s76c74wp4crfxxfqmi3ojox2jc7q

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\universaleternal\vmuniversal.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 001238599.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections