General

  • Target

    bdbe50403b411db0e07511e098bdb9ff.bin

  • Size

    596KB

  • MD5

    24e03008f43f9159d4a65388a8c1b972

  • SHA1

    ab5f863c38e4fc76311bfeba641912025aa2b113

  • SHA256

    373b1baa74d6263bf430ec9ccd99625a0ae5022dce042c9e9a2b1a43f57757a2

  • SHA512

    ea52dfbbbf40ca9f8fd5c5f47cf60970c20ae2d1a7ae2d497e1ba2d71a09e5459ecf6d4b295ee9d0a31f95991f3f9fa5e7800eaad9c450b1733d38cadefcc44b

  • SSDEEP

    12288:FudvnCdkq7Om9LwKuIE2JoA0pIaGRJpuLa95byeaRwwTcw3MpK1s:F2UkmOI1ty3zGRJHXbyeaTcH

Score
10/10

Malware Config

Extracted

Family

orcus

C2

obfuscated.us:8080

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bdbe50403b411db0e07511e098bdb9ff.bin
    .zip

    Password: infected

  • a758763a7fb30398cbdab370be24c389a1927fb376772fcb31f4017ca942a284.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections