Overview

overview

10

Static

static

10

fac2221482...2f.exe

windows7-x64

10

fac2221482...2f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fac22214821ec848d002303f8e071017b4988f692bec1c3ef666de4a7b07af2f

  • Size

    3.0MB

  • MD5

    f914c1271142dba84a1f252e6cc5bd62

  • SHA1

    b5c9469bad576f32904a428210ddcf4778575df4

  • SHA256

    fac22214821ec848d002303f8e071017b4988f692bec1c3ef666de4a7b07af2f

  • SHA512

    822c340cafc599ad7118c0dac257853a9afe8eb48cf47fd62717a0e8ff432c749d5b287a5f3706516ca939d948ef40be30e97471571e91d66038682c3fed6fe8

  • SSDEEP

    49152:+msonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCmwl6ncFf0I7s:+7CFmwLvEeMDjnpHfP56xypSb1o9JCm

Score
10/10
conflickerorcus

Malware Config

Extracted

Family

orcus

Botnet

Conflicker

C2

193.161.193.99:35081

Mutex

09bbf5ad32294289979fe0ce356efd76

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Config\Conflicker.exe

  • reconnect_delay

    10000

  • registry_keyname

    Conflicker

  • taskscheduler_taskname

    Secure

  • watchdog_path

    AppData\service.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • fac22214821ec848d002303f8e071017b4988f692bec1c3ef666de4a7b07af2f
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections