General
-
Target
2ab15702b4748af2a4e5a5dd58ff8dbd46c32e11c6fe7d2614dd9fc1d8490aed
-
Size
3.0MB
-
MD5
65379e4a2be83e0dca875e73c1b74c26
-
SHA1
cecf5d4106e3c62c5d5b631c077519e319457a41
-
SHA256
2ab15702b4748af2a4e5a5dd58ff8dbd46c32e11c6fe7d2614dd9fc1d8490aed
-
SHA512
77730e0e59315b84dbd8788b80539774a1b261d324d29e617a441f63fa0136a0370d4813d2cbb31f410b582a2f3c0a926acd7d16045b9f2f531f225ffd6486dd
-
SSDEEP
49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Новый тег
C2
31.44.184.52:36345
Mutex
sudo_dhu3cm84mifl18hx5btf2r94sygizy7t
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\jsdatalife\uploadslow.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2ab15702b4748af2a4e5a5dd58ff8dbd46c32e11c6fe7d2614dd9fc1d8490aed
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections