Overview

overview

10

Static

static

10

5e3dab3208...c9.exe

windows7-x64

1

5e3dab3208...c9.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    5e3dab320890ff285f1559acdb4b4fc68ba833e3755e8514a7bedb03f34883c9

  • Size

    910KB

  • MD5

    3814c7041e5e06a6d91a466f23a80d6f

  • SHA1

    4ccc4c4f6e3fab733cc8f25d7b6c2d0fc0d4b5b2

  • SHA256

    5e3dab320890ff285f1559acdb4b4fc68ba833e3755e8514a7bedb03f34883c9

  • SHA512

    7028316502252da19dc29b63f28cc5a273a3dcc974734f1357b4ce6cb69d7e366860034fed07de05441c233206856eea273fb1f34c51e02e62e1db0731460208

  • SSDEEP

    24576:ehg4MROxnFp/iJerZlI0AilFEvxHiPJ3:ehDMifK0rZlI0AilFEvxHiP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

s1.kekw.tk:1337

Mutex

c3bfded8fe9d44f492312e9ce58f4e74

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs

Files

  • 5e3dab320890ff285f1559acdb4b4fc68ba833e3755e8514a7bedb03f34883c9
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections