Trusted Design

Rurktar Backdoor

概要

There is a new malware called Rurktar[2]. It’s a trojan spy which is installed as service called RCSU. The service connects back to the attacker machine and waits for commands which will be given by the attacker. The file size of the malware is mostly around ~50Kb, as you can see from the list of sample hashes at the end of this report. Currently, the trojan spy is still in development and is not spotted in-the-wild yet. This could change once the trojan spy has fully developed.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - b4b75bda475ea58f2a5cf3329e311a70fa56745ba6cb2785523fa53139d4e37f -
• FileHash-SHA256 - 618908e3d368301a323ee8ae7df867db8d7f5a98b513cfb8c961fb945e62a9b6 -
• FileHash-SHA256 - 54f25a6820b8a0e3fc26bdf4599e7db695ef7aefb7dcefaa2c2581bb58426a40 -
• IPv4 - 80.78.251.138 -
• FileHash-SHA256 - 89110710eddd0da23ea206a6047c252bf1e16a2d1957729973d77a58219e614b -
• IPv4 - 80.78.251.148 -
• YARA - e1bb87306f8ad2d446a9413bdc381e412a37acf4 -

類似Pulses

• TrojanSpy:MSIL/Ruzmoil (score: 0.65)
• Backdoor:Win32/Saluchtra (score: 0.64)
• Trojan:Win32/Hilasy (score: 0.63)
• Backdoor:MSIL/Noobsrat (score: 0.62)
• Backdoor:MSIL/Noobsrat (score: 0.62)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る