General
-
Target
94a5c461cc8e9381cdc3c6cf4ada578b1e3753c0a82d04c2c84847fafd3a2c71
-
Size
3.0MB
-
MD5
2ef1cf4655e26edb165f16631c405fe7
-
SHA1
d553c1fc790285512d3805b7057663160e87143f
-
SHA256
94a5c461cc8e9381cdc3c6cf4ada578b1e3753c0a82d04c2c84847fafd3a2c71
-
SHA512
b1cfc48a3a2b134ac52d2b0be894fd1f820f5de7b97f468a0981e8ac021a99fd40fb0227108154fd9ddbf5a221aae8a0f3747edfc903b9da84dca36044111c69
-
SSDEEP
49152:K3X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qb:KWHTPJg8z1mKnypSbRxo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Новый тег
C2
31.44.184.52:62202
Mutex
sudo_uj2h50ln2d5idm8ywfr212r4wma3bhaw
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\requestjavascripttraffic\wordpresslocal.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
94a5c461cc8e9381cdc3c6cf4ada578b1e3753c0a82d04c2c84847fafd3a2c71
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections