Overview

overview

10

Static

static

10

6d62bd507f...af.exe

windows7-x64

10

6d62bd507f...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d62bd507f45d3dda13b1e20f71705e614c6601bf85c1add695f64f1ce25fdaf

  • Size

    3.1MB

  • MD5

    a440503b1c50894d954d12cc8e341e56

  • SHA1

    33489285a75483d33876baa5880dcf418394b80a

  • SHA256

    6d62bd507f45d3dda13b1e20f71705e614c6601bf85c1add695f64f1ce25fdaf

  • SHA512

    42f36a654ca1fb2868a7d1026ef118a398285307c8f44b4e8e6d9c6d8090368c59ea232955d131839d30e63a56e317d1e068e725324a44a473b4522b5655ac2c

  • SSDEEP

    49152:oP7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpiu/nRFfjI7L0qbg:oPHTPJg8z1mKnypSbRxo9JCml

Score
10/10
normorcus

Malware Config

Extracted

Family

orcus

Botnet

Norm

C2

31.44.184.52:61651

Mutex

AstraPublic

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\AstraLoader\Injector.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6d62bd507f45d3dda13b1e20f71705e614c6601bf85c1add695f64f1ce25fdaf
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections