Overview

overview

10

Static

static

10

232b207bb6...48.exe

windows7-x64

10

232b207bb6...48.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    232b207bb6bf55bd615ae02f4d176c48

  • Size

    907KB

  • MD5

    232b207bb6bf55bd615ae02f4d176c48

  • SHA1

    278a188a095c6232bd7570e97fae80b1c4041c4c

  • SHA256

    a754a7dd4fa2ad3f52aefe67444d38504e17da934f70a950fbe37fa371b74770

  • SHA512

    2f728ac3f0365bb0f4e803fef9a33fc921565c228de30741301b58bcbf0fcc1cf2295e4bf7773fb9e7764782b450a41d813c09bbecfb44987e20a370f66e64fe

  • SSDEEP

    24576:Iam4MROxnFj3drkxrrcI0AilFEvxHPGDOooC:IOMi1BqrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

nanonana24.ddns.net:8964

Mutex

8622a59555d147459f7618b06b9b686e

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %appdata%\Pix\Winlogon.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Pix

  • watchdog_path

    AppData\Watchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 232b207bb6bf55bd615ae02f4d176c48
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections