General

  • Target

    b4af3126655823c6b45c2584feccf38dd74fc661e6274fb5001c3d68e39afb4c

  • Size

    3.0MB

  • MD5

    a0bf0e1d9998071ab3eea44c602e62fe

  • SHA1

    abbfe33f050e0d86141e3d86353e442ec137ce5f

  • SHA256

    b4af3126655823c6b45c2584feccf38dd74fc661e6274fb5001c3d68e39afb4c

  • SHA512

    37c2c2716467f266c0119b8f951a141522422c4f9d0ea6f28c428b6064ae2c1547ee8637ac840c49d0b5aec1a1c89fb49372700b399db7154313f497b8e4afce

  • SSDEEP

    49152:O3X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qbE:OWHTPJg8z1mKnypSbRxo9JCm

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:58576

Mutex

sudo_2f0j3yx80ngl37acxfsp3wpr9q36wsle

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\javascriptpackettemp\lowbase.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b4af3126655823c6b45c2584feccf38dd74fc661e6274fb5001c3d68e39afb4c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections