General
-
Target
acda0cdbd6a9be7cc1df40923d57c6c0eeae28b8046130cc723c3b055d881f82
-
Size
901KB
-
MD5
03ca22eed7d6c8df6c8ad4c4e650ac9a
-
SHA1
8e72ef451ba7957c8aff58afa9f3f246eeb7484e
-
SHA256
acda0cdbd6a9be7cc1df40923d57c6c0eeae28b8046130cc723c3b055d881f82
-
SHA512
92d43f7395b0ab710e4470d93df27b6fd5f6067208c1fc160479e9f247790ca24e537df6b391fef842b06bfc80cde5ed57647a4a421426c5bc813037fbec1425
-
SSDEEP
12288:a8shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvB2:73s4MROxnF9LqrZlI0AilFEvxHiGy
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
modded
C2
10.0.2.15:6969
Mutex
b725370ceb8a45a0ace5e08a0654b176
Attributes
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
acda0cdbd6a9be7cc1df40923d57c6c0eeae28b8046130cc723c3b055d881f82
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections