Overview

overview

10

Static

static

10

ahk.exe

windows7-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ahk.exe

  • Size

    922KB

  • MD5

    fd8c295d75ffb1367e7f8248336fbdb7

  • SHA1

    52c3aed0df6a5f9751db4436f6a23e718ad164d7

  • SHA256

    cd6f3e3f4236416da3ab4d081e566e0be35eba76ea23dff0e1bc48e7ea306c82

  • SHA512

    c27eddce59609f602a8b0d2fff0fadbc3a9837093351048b7bf3d3a9a3a668eb02e9ec63513866b4d76db088472efe03947f4f71c72539daf1488de38dbc26e0

  • SSDEEP

    24576:0YE4MROxnFt3ptQhrZlI0AilFEvxHiGk:0Y3MijbirZlI0AilFEvxHi

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

centre-shaped.gl.at.ply.gg:30014

Mutex

4c00c390bbde49b981461b7b1b4120c5

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    C:\Windows\System32\Data\CheckUpdate.exe

  • reconnect_delay

    10000

  • registry_keyname

    winlogon

  • taskscheduler_taskname

    WinRAR

  • watchdog_path

    AppData\svchost.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ahk.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections