Overview

overview

10

Static

static

10

ca58c36228...f7.exe

windows7-x64

10

ca58c36228...f7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ca58c3622823c65d1a9b5a06d1b0b46cd7f6c46c6a7bc2dda5f1b1f52ea186f7

  • Size

    922KB

  • MD5

    4fe283a3f154f6be93049792146d573d

  • SHA1

    3ef55c3c8b177b500a2b28dd7e06c21e12db9124

  • SHA256

    ca58c3622823c65d1a9b5a06d1b0b46cd7f6c46c6a7bc2dda5f1b1f52ea186f7

  • SHA512

    405a45dd6bb745470deb1d01264ef97bc87c97c79b83a52e6bcdacd30e9a3f3ec0590b6888d35bc434ffe3a08177f003177ae0ddf026e8eb8129d29a82abd290

  • SSDEEP

    24576:fpj4MROxnFl3YumvrrcI0AilFEvxHPzoo2:fGMirkrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.188.89:80

Mutex

0b5d489804a141619b34602f97de829a

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    EULA Registry.json

  • taskscheduler_taskname

    Windows service

  • watchdog_path

    AppData\Windows Defender

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ca58c3622823c65d1a9b5a06d1b0b46cd7f6c46c6a7bc2dda5f1b1f52ea186f7
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections