Overview

overview

10

Static

static

10

sa.exe

windows7-x64

10

sa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    sa.exe

  • Size

    907KB

  • MD5

    777efc80c628bcc92a50898ede9e1c80

  • SHA1

    af992dee1ebaa4cbb9518812667d860e29430221

  • SHA256

    2e7dd72931ae6a9144b211c179f97c4e43ab5e65ff651b00182b2683ff15a00b

  • SHA512

    abaef18cbe7cb376ec976b5b6afe1f89dd6269bb3120ef312774349e13feb129481cf1b54c439d92459ef90ed4163c1302dbe449b63f8b419e16e4330c3473df

  • SSDEEP

    12288:wQPOz8R1b40S2REsb8J7dG1lFlWcYT70pxnnaaoaw37ueuRAvrZNrI0AilFEvxHG:4gg4MROxnF394rZlI0AilFEvxHiwg

Score
10/10
testorcus

Malware Config

Extracted

Family

orcus

Botnet

test

C2

de2.localto.net:41509

Mutex

5665f873f1964bc09e317cde0ffe2c7a

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\systemw\DSRHost.exe

  • reconnect_delay

    10000

  • registry_keyname

    DSRHost

  • taskscheduler_taskname

    DSRHost

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • sa.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections