Overview

overview

10

Static

static

10

2134.exe

windows7-x64

10

2134.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2134.exe

  • Size

    907KB

  • MD5

    a26163d72e671419744317a706a533f5

  • SHA1

    7209e079e23d707451b1cbaabbd923b6ab8c6f86

  • SHA256

    dd617f07d31dff51c538c7626782311c2f94b7e26188c3f9d6a6784ab839b5da

  • SHA512

    e9494ddf73a6e8ef2461d439329faddb04d7b50426ffeac9d4fd4f91e8c4b0fb5ebcf4c387fa6d0d9214a68c049dee6665c12441570bcaad4c678d11f2050feb

  • SSDEEP

    24576:ZKa4MROxnF0pSxXSArrcI0AilFEvxHPnoop:ZOMiSKSArrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

de2.localto.net:41509

Mutex

258334e365604d3ca90aaafdbf31c4c7

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\systemw\DSRHost.exe

  • reconnect_delay

    10000

  • registry_keyname

    DSRHost

  • taskscheduler_taskname

    DSRHost

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2134.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections