General
-
Target
f81db1fbc6bd739725e52ea0c8840c8609769cd80e638bc607cdc0f642cd861b
-
Size
3.0MB
-
MD5
2134eae35ce2a0c31e5cac30d77d2a03
-
SHA1
e35a2f53c0ea148686dba203fcf17fc5f3452185
-
SHA256
f81db1fbc6bd739725e52ea0c8840c8609769cd80e638bc607cdc0f642cd861b
-
SHA512
9d7dd3a9635ed668737dc243bc4af0f8b3d17045a9f8478f83d2076001d8c4713b75be0257ef1751c7eb1eb9c0794b6685f9977c9e74973a7ec1d004589f0fa4
-
SSDEEP
49152:b4i+9ZVQDN/ZKMFz5otCeEvsDKBaUy/jAG+fyWAypQxbfo9JnCmGgrrzI0AilFCG:bt+LelWp2MvljAG+fyxypSbfo9JCm
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
got
C2
127.0.0.1:10134
Mutex
981d32c2b2444d7ab93d390088e36222
Attributes
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f81db1fbc6bd739725e52ea0c8840c8609769cd80e638bc607cdc0f642cd861b
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections