Overview

overview

10

Static

static

10

4c59be9855...b2.exe

windows7-x64

10

4c59be9855...b2.exe

windows10-1703-x64

10

Resubmissions

28-03-2024 06:38

240328-hd4x3ace47 10

28-03-2024 01:50

240328-b9e59aae35 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

  • Size

    3.0MB

  • MD5

    e067840e2f9733e5d7bc083cc11ed4fa

  • SHA1

    4d9ad6f1c50a9eb4141a17a5af43f0e0c105b9e0

  • SHA256

    4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

  • SHA512

    278a8da77ac55e97776239813cc9b19940dc6e99a4792a4ecdc806a4b026fe3adb1b1cf6c169545569ef54cad07abc97dd1522fcb939eae2a03a9bd1d3e7f4ec

  • SSDEEP

    49152:WVFonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCmwKWnzFfGI7k:W9CFmwLvEeMDjnpHfP56xypSb1o9JCm

Score
10/10
conflickerorcus

Malware Config

Extracted

Family

orcus

Botnet

Conflicker

C2

Conflicker-35081.portmap.host:35081

Mutex

09bbf5ad32294289979fe0ce356efd76

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Config\Conflicker.exe

  • reconnect_delay

    10000

  • registry_keyname

    Conflicker

  • taskscheduler_taskname

    Secure

  • watchdog_path

    AppData\%appdata%\conflicker\conflicker.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections