Overview

overview

10

Static

static

10

c597474f74...30.exe

windows7-x64

1

c597474f74...30.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830

  • Size

    4.2MB

  • MD5

    423485438f9d865daf8e39b2c9cc993b

  • SHA1

    1cab541dfe2f647a4bd28b4e2e12d3917cd23d6d

  • SHA256

    c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830

  • SHA512

    f43d7452c01259cb790fc780f95b54642cb466c93e79565539340b7d9544017ecea11c5262366bad814895742258b0052fe17148d7498c0693cc6887974630fc

  • SSDEEP

    98304:3pX2LQT116ToppwMgVypSb2TgTUKo9JCm:h2A13ppwMgVypSQJC

Score
10/10
новый тегorcus

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

128.59.46.185:50272

Mutex

sudo_8n66s76c74wp4crfxxfqmi3ojox2jc7q

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\universaleternal\vmuniversal.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections