General
-
Target
0x0009000000014b5d-74.dat
-
Size
3.0MB
-
MD5
fd560527411b6fc1dec327027f1b6a51
-
SHA1
056c4273219177194fa2d4c7cd308470391a4c53
-
SHA256
4b632ccdd041def4ecbaf20f41033ebcd8317ad696ccc66de1544868f1d7fb61
-
SHA512
ca9d08e114656441a4378c8232021e570e577a2aed27fbb53f286c76910ecb8aaa5e87cf83d0b529f0b9072ac919d83b94afa64ddfde0f7d3b29213dae70b988
-
SSDEEP
49152:Jsa3PHJZKMvup/RGA1Ub/6U3bFaAypQxbzkso9JnCmaukrrzI0AilFCvxHI:JjGUu1D1Uj6UnypSbzPo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Sln
C2
193.138.195.211:10134
Mutex
eaf050d367294b239fe7db992d6ea4d7
Attributes
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\svchost.exe
-
reconnect_delay
10000
-
registry_keyname
svchost
-
taskscheduler_taskname
svc host
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
Files
-
0x0009000000014b5d-74.dat
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections