Overview

overview

10

Static

static

10

76f99ba1ba...7c.exe

windows7-x64

10

76f99ba1ba...7c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    76f99ba1ba37dacb01e61a67131f727c

  • Size

    919KB

  • MD5

    76f99ba1ba37dacb01e61a67131f727c

  • SHA1

    bd3398225e6a55c61595ada15d7c44cf72ac0ce0

  • SHA256

    78b898d8c0c3d4f01b36507c63d69892574c6c5a9e002a957721cdd703d31796

  • SHA512

    061881edaa2e7b48a840725a1c34649ade858a4d968b541603cd71a2625591cace73fc08547a560b1ac196e6850db4868fad4c61ac5d10422ae07e4fde407726

  • SSDEEP

    24576:Ygg4MROxnFH3mkTZkrZlI0AilFEvxHiCM:YgDMihWrZlI0AilFEvxHi

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

texeshserver.ddns.net:42069

Mutex

d4706f740af44a29963647b1d524d7f3

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %appdata%\_Net_Framework\Net.exe

  • reconnect_delay

    10000

  • registry_keyname

    _Net_Framework

  • taskscheduler_taskname

    _Net_Framework_

  • watchdog_path

    Temp\_Net_Framework.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 76f99ba1ba37dacb01e61a67131f727c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections