Overview

overview

10

Static

static

10

34.exe

windows7-x64

10

34.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34.exe

  • Size

    914KB

  • MD5

    4c81b71ba47ec8254bd27b871c21cd00

  • SHA1

    fd72361605f3251a776673bd3aedacd218213663

  • SHA256

    bb6d990878c675bb7c602016d7b829902f63e64bbcabc365f5637d3249c3566d

  • SHA512

    2eba64932a49da8bfe1f0390287ab9c89df39b80d28aba7cdc82be17623a5a6075d2756642848ec0d145475d294716916c181b0f0ee53efc2150e0003788fb56

  • SSDEEP

    12288:agfe07KFML7iLMucoUe7dG1lFlWcYT70pxnnaaoawBmDcfpLF9VV64brZNrI0Ai3:rtY4MROxnFGrZlI0AilFEvxHi/w2

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

de2.localto.net:41509

Mutex

258334e365604d3ca90aaafdbf31c4c7

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\systemw\DSRHost.exe

  • reconnect_delay

    10000

  • registry_keyname

    DSRHost

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 34.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections