General

  • Target

    a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b

  • Size

    22.9MB

  • MD5

    c3250c3541382fc0bd8f14229e5fc721

  • SHA1

    ca91e11b8ad65c492912de4401cbcbfecd45d02f

  • SHA256

    a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b

  • SHA512

    d341aa7aad0adc81b80b9b2b23066f3b78a91711fa434496378f3f615356f1a72603d1ba7313ef5700ac13a08b4552d84e168de61a64eaf7ee727a1fbd889fbe

  • SSDEEP

    24576:Fkk4MROxnFSx3sUzrrcI0AilFEvxHP+ooU:FmMiYJsUzrrcI0AilFEvxHP

Score
10/10

Malware Config

Extracted

Family

orcus

C2

0.tcp.eu.ngrok.io:11649

Mutex

91ae58d9b49a47b0933d6314024a6ff7

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Chrome Update\Chrome Network.exe

  • reconnect_delay

    10000

  • registry_keyname

    Telegram Update

  • taskscheduler_taskname

    svhost

  • watchdog_path

    Temp\System Files.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a29400e0ab5d6053fa0282250f76133714c09580e023a379728d37c6ba21317b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections