General

  • Target

    file.exe

  • Size

    914KB

  • MD5

    c9b1f9e57bf2dbc30e4fa277ce690be0

  • SHA1

    08db2e77e4631ba758988b9ece9c44ec7531a9ea

  • SHA256

    786a9cf7ceaa5f95907624ad42193b1a9581b56eac4689374a68f0cd6069f0f6

  • SHA512

    a0497f8e06674749c7d9ff875c1f2fd6b0398328393304bc07883cb63f65af5460cb8966e62917a72c09b3b4f57c060e27f93615bac3c2d898ddc0ffb1ae86f0

  • SSDEEP

    24576:3W64MROxnFD3orXYf1rrcI0AilFEvxHPHooX:3KMiJhrrcI0AilFEvxHP

Score
10/10

Malware Config

Extracted

Family

orcus

C2

4.tcp.eu.ngrok.io:15428

Mutex

0133d229c4e24006957c0e4ab3a52531

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\\gcc\gcc.exe

  • reconnect_delay

    10000

  • registry_keyname

    System3222

  • taskscheduler_taskname

    System3222

  • watchdog_path

    AppData\Sys322.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • file.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections