Overview

overview

10

Static

static

10

f59da3d152...36.exe

windows7-x64

10

f59da3d152...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f59da3d152a1e26274c53f3c00dd2a3b985d8cfeb38978939d034eda48111336

  • Size

    3.0MB

  • MD5

    ddfd61ebcea6cf606e01cc44ad001e23

  • SHA1

    e205582ab97f373ac2a68adda1fc30be3a0688bd

  • SHA256

    f59da3d152a1e26274c53f3c00dd2a3b985d8cfeb38978939d034eda48111336

  • SHA512

    1e1a81a95a5429b55f955614cbd5f79149c9128292315749d1e7bfd56a38184a60e44f68f118a3d54c55a5a4bb8083fa19592037b3b08bd295f16a631bbf2dc5

  • SSDEEP

    49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm

Score
10/10
новый тегorcus

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:16749

Mutex

sudo_a0xg86oehgzthnn0dv6i9lic4rxumtv1

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\trafficphppublic\javascriptasync.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f59da3d152a1e26274c53f3c00dd2a3b985d8cfeb38978939d034eda48111336
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections