General
-
Target
f968e51569c3cd788933a632b81cd1529ed658bdacc5f66565a4be3c807a081c
-
Size
911KB
-
MD5
8efd8e9cdabd7b0886c97fa101a3ed13
-
SHA1
3ddc8f6c6a7705e19a1842dd6eceea9a05c254b9
-
SHA256
f968e51569c3cd788933a632b81cd1529ed658bdacc5f66565a4be3c807a081c
-
SHA512
8fcf2742bef2a781770f7392f05a566780515fb2baa68c3ef732514ce851f116f51e85f78742695a30c284f761d2949992e235d4b67c80b74a81e390a654cb09
-
SSDEEP
12288:0y50ed4DkhUo2y27dG1lFlWcYT70pxnnaaoawl7ueuRAGrZNrI0AilFEvxHvBMr3:BzA4MROxnFt9prZlI0AilFEvxHivc8
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Tag
C2
192.168.0.108:10134
Mutex
1b73c8dc9189428b9ebc535fba0382af
Attributes
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f968e51569c3cd788933a632b81cd1529ed658bdacc5f66565a4be3c807a081c
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections