General
-
Target
winla.exe
-
Size
918KB
-
MD5
abbd2ba17bece747c5434dc4b71c15ed
-
SHA1
61872670bdb6cb3b0f2262be77ff1cb28636fc1d
-
SHA256
511305e006736b331aa4fd7b6237b6ec49096eb5a6f1543676846d031af02b9a
-
SHA512
4861d851b52a50a5db5a456de4d1709a028eb720cbe61c94ae04d0838f7121033aecd2594ff5b4c2253f439b57d9513f9f41e31877a3530a5e1133d2fe1e997e
-
SSDEEP
24576:md74MROxnFH3WRM48rrcI0AilFEvxHPWaooQ:maMihWl8rrcI0AilFEvxHPW
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Mal
C2
comes-drew.gl.at.ply.gg:22718
Mutex
3bd064b7c6b7453ba4e355a8c39c2b4a
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Radeon\RadeonSoftware.exe
-
reconnect_delay
10000
-
registry_keyname
winla
-
taskscheduler_taskname
winlaa
-
watchdog_path
Temp\AMDRSServ.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
winla.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections