General
-
Target
2A1C375935C741C5C329A614389E75F7.exe
-
Size
919KB
-
Sample
210418-6pbpxwr98j
-
MD5
2a1c375935c741c5c329a614389e75f7
-
SHA1
6e4aa9a62dc23d23e176551d0d35baebd9fb73cb
-
SHA256
53943895601cbc79561cb30c9957715400d82a255d97ce36fe1b383bf3c240da
-
SHA512
355b17d541962cde36c357f16c0eae231e112bd2d77ae4fb8bb27f7d767b076e37e0762c8e7f6dcc8edf27f171659f2418db9625c9600bff3b0f1dace1bc3c54
Static task
static1
Behavioral task
behavioral1
Sample
2A1C375935C741C5C329A614389E75F7.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2A1C375935C741C5C329A614389E75F7.exe
Resource
win10v20210410
Malware Config
Extracted
orcus
98.229.214.124:10134
b1eacede88674ba6a69fac5ec304eeee
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Dababy\Dababy.exe
-
reconnect_delay
10000
-
registry_keyname
lol
-
taskscheduler_taskname
lol
-
watchdog_path
Temp\lIlIlIlIlIlIlIlIlI.exe
Targets
-
-
Target
2A1C375935C741C5C329A614389E75F7.exe
-
Size
919KB
-
MD5
2a1c375935c741c5c329a614389e75f7
-
SHA1
6e4aa9a62dc23d23e176551d0d35baebd9fb73cb
-
SHA256
53943895601cbc79561cb30c9957715400d82a255d97ce36fe1b383bf3c240da
-
SHA512
355b17d541962cde36c357f16c0eae231e112bd2d77ae4fb8bb27f7d767b076e37e0762c8e7f6dcc8edf27f171659f2418db9625c9600bff3b0f1dace1bc3c54
Score10/10-
Orcus Main Payload
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-