Overview

overview

10

Static

static

10

24db4a99eb...18.exe

windows7-x64

10

24db4a99eb...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    24db4a99eb4c717414edcab0792214608a2a80cea641a19749d3485dc6711a18

  • Size

    3.0MB

  • MD5

    6de6582c0bdd97deeabdc6a316078aa2

  • SHA1

    ee8a2fc6e9c4bd02470d75d700944ce999e6077c

  • SHA256

    24db4a99eb4c717414edcab0792214608a2a80cea641a19749d3485dc6711a18

  • SHA512

    2f7042132bebf16f7bb50ca642a2fd58d47daa6a4a7d6d108109d96bbaf84ab8d93abd1dd3355a6b4f653d067c85cc1b38cbe0c082921765acd7945715dd7f31

  • SSDEEP

    49152:moMN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmlWncFf0I74gu3kM:mL0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
game-ddorcus

Malware Config

Extracted

Family

orcus

Botnet

Game-DD

C2

kissmyasshole.myddns.me:6666

Mutex

33814f49e9c24405a29c00ff4d60b0c1

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\CTF Loader.exe

  • reconnect_delay

    10000

  • registry_keyname

    Netstack

  • taskscheduler_taskname

    Netstack

  • watchdog_path

    Temp\IntelAudioService.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 24db4a99eb4c717414edcab0792214608a2a80cea641a19749d3485dc6711a18
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections