Overview

overview

10

Static

static

10

a97a1a2989...5c.exe

windows7-x64

10

a97a1a2989...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c

  • Size

    3.0MB

  • MD5

    62b979701e8d5ff4c7c49af4c4b69dca

  • SHA1

    ff23caf424ade62e9d789cb823cbf9eb0fc3d9ed

  • SHA256

    a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c

  • SHA512

    d6d747f94e1b82d4f7b701bceeb2f0d2e02858dd08e50d38272a457554063ebbfecbf368c4298e6a83fa36a9d1cd73949bbe7683248802405672a2f9591e85b6

  • SSDEEP

    49152:ys7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:ysHTPJg8z1mKnypSbRxo9JCm

Score
10/10
packlaborcus

Malware Config

Extracted

Family

orcus

Botnet

packlab

C2

31.44.184.52:50079

Mutex

sudo_ld91xbpc2kl6yn2iq5m7rnm9wlvhevm0

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\geoprivateline\wpwordpress.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a97a1a2989aa0376a945702d56b3e48f689873222c5ff3605d2ceced2fcc395c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections