Overview

overview

10

Static

static

10

Invoice_Fi...DF.exe

windows7-x64

10

Invoice_Fi...DF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Invoice_Finance_US-Factoring-Discounting.PDF.exe

  • Size

    922KB

  • MD5

    d3278b4f22e455acad9bdee1980b88f4

  • SHA1

    a56bde215dffa46c3e4271c67147063e05178943

  • SHA256

    586e9be679cd4ce057b9df104d02de3447551583ff3e57c93bc96bdd9fb524cf

  • SHA512

    4eacdac9f55b223263fcd959ec074db035ede80f4a76a0073c508d0a36cc13a71d95d40a6121fabc5e0145ec7b114234bf722d1b8ab417e4ce0fa97e106f5ea8

  • SSDEEP

    24576:bmHR4MROxnFlQXrrcI0AilFEvxHPloo1:auMi4rrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

193.169.255.152:6969

Mutex

362a2958fe1c40c0bd8389dcdc6ae139

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Invoice_Finance_US-Factoring-Discounting.PDF.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections