Overview

overview

10

Static

static

10

3CA48ED8ED...AE.exe

windows7-x64

10

3CA48ED8ED...AE.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3CA48ED8ED5DB1AE5411874D38DF2FAE.exe

  • Size

    903KB

  • MD5

    3ca48ed8ed5db1ae5411874d38df2fae

  • SHA1

    b11f11656ffe0bd0f96955b6cbe2545a4ed3429f

  • SHA256

    d707f6a2b397255561908bd80c63d29237ea0b70e44360b10ebc5abd7b798b50

  • SHA512

    8ff797fac2306b41c6be0e51006e0dd3f1db4675449339bcdb75bc42954bd84c6763f4b0ebeaa72c22ae10ec0be51c9415e2169f80f3e612182cefe20141d66a

  • SSDEEP

    24576:U8HQ4MROxnFDi0rrcI0AilFEvxHj60kQU:UAzMi40rrcI0AilFEvxHjx

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

period-disabilities.gl.at.ply.gg:56901

Mutex

3a15a41ea1f0476db682988f07b7f957

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3CA48ED8ED5DB1AE5411874D38DF2FAE.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections