General

  • Target

    2ca341bc60674d590069eb99e8bf2ecb8cbf44c0fd0d40e7a7b870f05b5a900c

  • Size

    1.1MB

  • MD5

    34b6450b9e4e3b3727ff9d7e9c790d34

  • SHA1

    edbbd2c236ac2fe7402b938199b70f3510c2c58c

  • SHA256

    2ca341bc60674d590069eb99e8bf2ecb8cbf44c0fd0d40e7a7b870f05b5a900c

  • SHA512

    65349b6632615201537f9f1791f52de07d1ee101edddc1696916dfb02b320c45272be95286b25c4a743cf6b8889489f6e7b93c774ded6c46b98a74337748da38

  • SSDEEP

    24576:H884MROxnFE3ci3rrcI0AilFEvxHPpoot:HGMiuv3rrcI0AilFEvxHP

Score
10/10

Malware Config

Extracted

Family

orcus

C2

0.tcp.eu.ngrok.io:12187

Mutex

f78b25f6477f429680c2e1eadc9b201c

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\svchost\svchost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\svchost.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2ca341bc60674d590069eb99e8bf2ecb8cbf44c0fd0d40e7a7b870f05b5a900c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections