Overview

overview

10

Static

static

10

ExeraLoader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ExeraLoader.exe

  • Size

    3.0MB

  • MD5

    967a76406b833408269300b470cba1d7

  • SHA1

    1988b2f59f9dcc09035ba413d1a81f724ce6d727

  • SHA256

    226ec253ffea4cf694beead5ee591540a056fbf423bdf39f7f1ce7f17241aa79

  • SHA512

    1d36400a043c30f0f76e117287a2a05d0dedb322ab1a38db8e4990c155ccf14f60a54f81ae4860f6b4e35a411d9ea15388b3c2cfd3ef81bb5673d2c362200dd2

  • SSDEEP

    49152:Cs7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpau/nRFfjI7L0qb:CsHTPJg8z1mKnypSbRxo9JCm

Score
10/10
exeradbdorcus

Malware Config

Extracted

Family

orcus

Botnet

ExeraDBD

C2

31.44.184.52:57581

Mutex

sudo_cphi4rohn8s06p230o7ave0vlq6yznce

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\linelinux\protectgeo.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ExeraLoader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections