General
-
Target
ee1f504b516b101a9d08e411e9e02391962732280a22e96fcb6e0730fa5619ea
-
Size
3.0MB
-
MD5
7a624c44e8be165b539f4604c2181f65
-
SHA1
0d9744ad8752b59d872eeb24abe92835ef793c58
-
SHA256
ee1f504b516b101a9d08e411e9e02391962732280a22e96fcb6e0730fa5619ea
-
SHA512
e1b47d0b048058a260c3c183083ac4643a76edd6eb969558eb05d46312cf9ad8c1961f823d40fadfddec630d5ea0290b835bdae7d654f77d48e7067a6416e467
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Новый тег
C2
31.44.184.52:12708
Mutex
sudo_u1r2jdrjb1fc5k3jeo9fv58lnpfbyogh
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\universaltrack\longpolleternal.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ee1f504b516b101a9d08e411e9e02391962732280a22e96fcb6e0730fa5619ea
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections