Overview

overview

10

Static

static

10

svchost.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    922KB

  • MD5

    d51d063b7bc6aed7cc10708bf8176c1b

  • SHA1

    149b031bacb0b15af7b46a24c772ff4d8e284929

  • SHA256

    39e5f3d7ac19b95f26594f4eaf073b354c1ab96ae02b3c73ffa68c7d0ae3e153

  • SHA512

    0961b540ec96af7690b6c75fae292a32681b34d6b9f8be29a069565572fa8369b325b7d71fbff41b030061767212de20cee27279c8bd6f0e174b401d4ca2ff67

  • SSDEEP

    24576:ZEO4MROxnFt3gtQZrZlI0AilFEvxHiieqdb:ZENMijYurZlI0AilFEvxHiieq

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

centre-shaped.gl.at.ply.gg:30014

Mutex

ff579f95cc0a4d5da4c6e63a340f88f9

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    C:\Windows\System32\svchost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Update

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\svchost.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • svchost.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections