Static task
static1
Behavioral task
behavioral1
Sample
2A1C375935C741C5C329A614389E75F7.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2A1C375935C741C5C329A614389E75F7.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
2A1C375935C741C5C329A614389E75F7.exe
-
Size
919KB
-
MD5
2a1c375935c741c5c329a614389e75f7
-
SHA1
6e4aa9a62dc23d23e176551d0d35baebd9fb73cb
-
SHA256
53943895601cbc79561cb30c9957715400d82a255d97ce36fe1b383bf3c240da
-
SHA512
355b17d541962cde36c357f16c0eae231e112bd2d77ae4fb8bb27f7d767b076e37e0762c8e7f6dcc8edf27f171659f2418db9625c9600bff3b0f1dace1bc3c54
Score
10/10
Malware Config
Extracted
Family
orcus
C2
98.229.214.124:10134
Mutex
b1eacede88674ba6a69fac5ec304eeee
Attributes
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Dababy\Dababy.exe
-
reconnect_delay
10000
-
registry_keyname
lol
-
taskscheduler_taskname
lol
-
watchdog_path
Temp\lIlIlIlIlIlIlIlIlI.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule sample orcus -
Orcus Main Payload 1 IoCs
Processes:
resource yara_rule sample family_orcus -
Orcus family
Files
-
2A1C375935C741C5C329A614389E75F7.exe.exe windows x86