Behavioral task
behavioral1
Sample
e2c0306edd4b68a13f83a4ebccbe88396603a7a60e1347012ad89d458f9403a2.exe
Resource
win7-20240221-en
General
-
Target
e2c0306edd4b68a13f83a4ebccbe88396603a7a60e1347012ad89d458f9403a2
-
Size
3.0MB
-
MD5
d5f859cae99e2d0d7a4917258786439a
-
SHA1
faa6dac4b01b4f53d53aaf8f94b6439765e75048
-
SHA256
e2c0306edd4b68a13f83a4ebccbe88396603a7a60e1347012ad89d458f9403a2
-
SHA512
3df289e81668e7f34432dd1bf3d104c95dd27ce39d8caacb4269c6b98e4ed5f73c3b75c78de70a12d43601587eef256ff4696023029c840c486e02d91cf0a98a
-
SSDEEP
49152:MC9onuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCmAkuncFf0I7X:M8CFmwLvEeMDjnpHfP56xypSb1o9JCm
Malware Config
Extracted
orcus
192.168.1.158:10134
abf49151fe5a430081f0ca5733679373
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2c0306edd4b68a13f83a4ebccbe88396603a7a60e1347012ad89d458f9403a2
Files
-
e2c0306edd4b68a13f83a4ebccbe88396603a7a60e1347012ad89d458f9403a2.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ