Overview

overview

10

Static

static

10

3fa94387a1...ac.exe

windows7-x64

1

3fa94387a1...ac.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fa94387a1ff3c76b7b414cfb51457e28ac0493c1de2739d6c39e37e9602deac.exe

  • Size

    913KB

  • MD5

    42b16240015658fba13097e399a64ee7

  • SHA1

    69860a526a3e385c02530b747a98daa4a34961d9

  • SHA256

    3fa94387a1ff3c76b7b414cfb51457e28ac0493c1de2739d6c39e37e9602deac

  • SHA512

    d7443e63d0ce6383d533a96178dbd1798e7da2322e08c4c5e00af42003b120266c60e8b00d222f4dcd79cf80cefe6a086e383ef566aaee57ca4dd5fdd02a4f95

  • SSDEEP

    24576:AEqr4MROxnF25bHKTlQlrZlI0AilFEvxHidlN:AEjMiwlrZlI0AilFEvxHid

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

openport.io:20910

Mutex

3889d22d14af4d91a21ad24c56d0cac9

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3fa94387a1ff3c76b7b414cfb51457e28ac0493c1de2739d6c39e37e9602deac.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections