General
-
Target
8f10f663aa1b1b6c55154a8fddc0405a52a48eee8db143eba2172451f5d60da9
-
Size
3.0MB
-
MD5
63b97c1f234481feb39c12108cf95a6c
-
SHA1
dbdd351046ef9a2fef1e311dc6abdea1f8136414
-
SHA256
8f10f663aa1b1b6c55154a8fddc0405a52a48eee8db143eba2172451f5d60da9
-
SHA512
f2e80ff5a210c00fe1dfabe8c5c77affee3aa191d57feff0ecb715a1b51898673fd95ee9d12676bb9ddb111bdc9f0b5c974edb8466b7982640bd9a533dd007b5
-
SSDEEP
49152:Cs7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:CsHTPJg8z1mKnypSbRxo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Новый тег
C2
31.44.184.52:24706
Mutex
sudo_9ujfjqyd5oihliwxnmlbee3o45i48x9b
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\defaultto\windowslocal.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
8f10f663aa1b1b6c55154a8fddc0405a52a48eee8db143eba2172451f5d60da9
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections