Behavioral task
behavioral1
Sample
9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16.exe
Resource
win10v2004-20231215-en
General
-
Target
9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16
-
Size
1.1MB
-
MD5
f6ccd7d54c0d360846211977110a7c20
-
SHA1
be26eb65426c1ac5a4b45d6493cc3c810f6a2419
-
SHA256
9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16
-
SHA512
8c208674cbb6947db7f67150382124d0665d9fbb3ae0770fce88bbfa8ccb160cdb68e56a0d7416d60b242354524cbd05a8ccbc83a87adb75e9bd60845f5ad190
-
SSDEEP
24576:FD9O4MROxnFE30dc1RurZlI0AilFEvxHi6G:FhNMiuHburZlI0AilFEvxHi
Malware Config
Extracted
orcus
6.tcp.eu.ngrok.io:12457
bff5c852ae7b4868a2aa18ea8de24aa3
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%programfiles%\svchost\svchost.exe
-
reconnect_delay
10000
-
registry_keyname
asaas
-
taskscheduler_taskname
svchost.exe
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16
Files
-
9f0112d3238fea7397c5641f9e4bda829257030638d12e6c7568f79988e8cc16.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 922KB - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 251KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ