Overview

overview

10

Static

static

10

131607fdc9...9e.exe

windows7-x64

10

131607fdc9...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    131607fdc98a5a6005a3e2ed447a9a646a2b5fd37d0d69d19bc6ff446712d69e.zip

  • Size

    590KB

  • MD5

    76ceddf2b523f448b70be353ccbe9f49

  • SHA1

    a977ea3948f550a5b4b0fccc2bc6eb7b9369f102

  • SHA256

    860a91929d180d1793d22d43b7815e0b0ef5dcdd74a235427c7063b15b141724

  • SHA512

    2054961a98e491d7c9cbcbc448d1e3ad4a5b395e9766987ac4a02b0159666db7329d143f5f23591b97ecb9585f2c2c03e2c3b582d49426d2a325f8843a374e14

  • SSDEEP

    12288:NRdMY/C3TQw0xRNvQhfsCGnfdkwrKTa1nVDiUN+SbymLkmjDQ:7dMsvw0FvQh0b1kfToVnNVumQmjE

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

45.81.39.83:3456

Mutex

4912f043b8a245f39167b534cb611529

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs

Files

  • 131607fdc98a5a6005a3e2ed447a9a646a2b5fd37d0d69d19bc6ff446712d69e.zip
    .zip

    Password: infected

  • 131607fdc98a5a6005a3e2ed447a9a646a2b5fd37d0d69d19bc6ff446712d69e.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections