Overview

overview

10

Static

static

10

5d203977f8...89.exe

windows7-x64

10

5d203977f8...89.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5d203977f820dcaf8e925a4e60fef8b8b5142ec73ac97d35cec32065406f2289

  • Size

    907KB

  • MD5

    f692c42efe49c5d0eab172397244642d

  • SHA1

    446de62aa35d334d3f8e62f9ad125bbd4e9bd7ff

  • SHA256

    5d203977f820dcaf8e925a4e60fef8b8b5142ec73ac97d35cec32065406f2289

  • SHA512

    ebc65e0f852e54be1ab6b15354dd583e6e0f678110f06854400acc47584e227adacbd0edca846bd280bf3399811519bfcc71e0506816b9e93a0ae362d0dc6fcb

  • SSDEEP

    24576:v0M4MROxnFj3rrkxrrcI0AilFEvxHPpP3ooI:vuMi1fqrrcI0AilFEvxHPp

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

147.185.221.17:54772

Mutex

12e5f394804c4209bf3582a4a4d91589

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Outputs Audio\Windows Audios.exe

  • reconnect_delay

    10000

  • registry_keyname

    Audio Manager

  • taskscheduler_taskname

    Windows Outputs

  • watchdog_path

    AppData\Windows Managers.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5d203977f820dcaf8e925a4e60fef8b8b5142ec73ac97d35cec32065406f2289
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections