General
-
Target
8d1a05ff1a2927d407fe510fa5d7f07b14abe5b9ba7590f38a323132e72f1368
-
Size
3.0MB
-
MD5
05e862cf192ab673e8007771ff34217f
-
SHA1
3c3de81427033b7cd1ea1b215526f11b856689b8
-
SHA256
8d1a05ff1a2927d407fe510fa5d7f07b14abe5b9ba7590f38a323132e72f1368
-
SHA512
2f31538c5ef628d80353d4d0423122633a38d6a121b88fa43976ab8c8c8dd0d50f995fab0823aa290b981a72542b4ee8d8dd8e2f9d308d34d0e592e44703abae
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Вагина зебры
C2
31.44.184.52:47228
Mutex
sudo_9n5pq11hiwegzy50mtqdvrdubhlf7ear
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\cpuauth\universal_.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
8d1a05ff1a2927d407fe510fa5d7f07b14abe5b9ba7590f38a323132e72f1368
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections