Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    test.exe

  • Size

    924KB

  • MD5

    e0e547d76edcd7f473c3ee28f69bc3e0

  • SHA1

    897c40c0387402426b33ef195ea334cd097767e6

  • SHA256

    c0a362f8a096093d7fa26af03014b69224e95ef1f8011a7a6461f0848d2ce61d

  • SHA512

    d567f0705a6c1c4b03ad61e8029e995978f220690bbd966172d5190f1e946568e351a88fa8ad2d0f112549a4290828110733b7eba11b09bc1f22cb742584adcb

  • SSDEEP

    24576:ZmHR4MROxnFE3kO3vrrcI0AilFEvxHPh4oog:QuMiuBvrrcI0AilFEvxHPh

Score
10/10
lox_228orcus

Malware Config

Extracted

Family

orcus

Botnet

lox_228

C2

192.168.2.229:7777

Mutex

7e6191bc99f745599156ed7338a596a3

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • test.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections