Overview

overview

10

Static

static

10

da79b06e95...22.exe

windows7-x64

10

da79b06e95...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

  • Size

    907KB

  • MD5

    fe72a29c3b2ac5e7d210a0ebe2fc4770

  • SHA1

    396d80f0ed22547ebe88bfa80ab8b0e3c80cb045

  • SHA256

    da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

  • SHA512

    df077ac0347bbc121cf93d703d510b76077aa7b7df4cf649bd5e464d315ad8f934c67ebbb8e26b9cc147043cc6fa4c36712f0ced521b51bbd3b2c744b44adb3f

  • SSDEEP

    12288:50XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCOcpCwFu/7u2pExO9u7dG1lFlW1:ncS4MROxnF2xPrrcI0AilFEvxHj8xQJ

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

nonamedc.mcv.kr:80

Mutex

ecce2d674bcb411599c6f4e988c6a8b5

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections