Overview

overview

10

Static

static

10

VT bypass binder.zip

windows7-x64

1

VT bypass binder.zip

windows10-2004-x64

1

VT bypass ...UI.exe

windows7-x64

1

VT bypass ...UI.exe

windows10-2004-x64

1

VT bypass ...XZ.exe

windows7-x64

10

VT bypass ...XZ.exe

windows10-2004-x64

10

VT bypass ...ld.ahk

windows7-x64

3

VT bypass ...ld.ahk

windows10-2004-x64

3

VT bypass ...lt.ico

windows7-x64

1

VT bypass ...lt.ico

windows10-2004-x64

3

VT bypass ...ut.exe

windows7-x64

VT bypass ...ut.exe

windows10-2004-x64

VT bypass ...rm.exe

windows7-x64

3

VT bypass ...rm.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    VT bypass binder.zip

  • Size

    1.8MB

  • MD5

    b54f5e096680ce04840702e48b7d166b

  • SHA1

    9178d17c87efc2b1cb4d080df7ac1dbc9e6646c7

  • SHA256

    2864e500977882a37f0ff762a2918ce8d228ebdd583f66ffc1abcced8ef1155c

  • SHA512

    d9a4a89fcf32d71fc73372bcb0192c981b20214760b5b7f628b52188010bdad228a3e98ba05953dac282e991b32564abf02404708a545f5875092a4ec82f5bd0

  • SSDEEP

    24576:V6fBpErZUevseeSKsqJJu4BPtSh03zfixEd1P3gLUB3g5BbkRie6XJLF7oKJqGBv:MrCVvse3T4BPoqWad133g3ARE95Jq6

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

groups-opportunity.at.ply.gg:55025:49668

Mutex

e0eb928c842e4900aa44b95bd0163372

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • VT bypass binder.zip
    .zip
  • VT bypass binder/BypassGUI.exe
    .exe windows:5 windows x64 arch:x64

    b66b962f1654841b6655c9e59651771a


    Headers

    Imports

    Sections

  • VT bypass binder/PythonXZ.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • VT bypass binder/build.ahk
  • VT bypass binder/default.ico
  • VT bypass binder/output.exe
    .exe windows:5 windows x64 arch:x64


    Headers

    Sections

  • VT bypass binder/sexclitxworm.exe
    .exe windows:5 windows x64 arch:x64

    b66b962f1654841b6655c9e59651771a


    Headers

    Imports

    Sections