Behavioral task
behavioral1
Sample
89c5286c617dd100d766fb7c96f435985f049d3f9f2287296e24aa0cfd89cf2c.exe
Resource
win7-20231215-en
General
-
Target
89c5286c617dd100d766fb7c96f435985f049d3f9f2287296e24aa0cfd89cf2c
-
Size
924KB
-
MD5
510378fe54cf8905e149633f19222774
-
SHA1
5176c1d7eaaa9534574acc23e6ad4971143c09d8
-
SHA256
89c5286c617dd100d766fb7c96f435985f049d3f9f2287296e24aa0cfd89cf2c
-
SHA512
8a1382099be67f4813f51fa0a2fbb56d6cc4641b4d7367dad8203e1f53b972557e4c57e4aeb3aab23847284521b0164fa321a1ae747d92c46fe8fc0ed335b10a
-
SSDEEP
24576:MIY4MROxnFE38O3/rrcI0AilFEvxHPRoob:MaMiuZ/rrcI0AilFEvxHP
Malware Config
Extracted
orcus
2.tcp.eu.ngrok.io:11400
7eb3a21106a44729b19c6c719396d2c2
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Update Explorer
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\System32.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c5286c617dd100d766fb7c96f435985f049d3f9f2287296e24aa0cfd89cf2c
Files
-
89c5286c617dd100d766fb7c96f435985f049d3f9f2287296e24aa0cfd89cf2c.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 921KB - Virtual size: 920KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ