General
-
Target
fc4dd137ffd09c6a501fc7f09f66eff4b50dc5b559bb5afcbb458f5c8e635c8e
-
Size
911KB
-
MD5
3fe5460632fb81e371b7498b83dfc4eb
-
SHA1
a945505d6cec24914499c3017140122adc9c37be
-
SHA256
fc4dd137ffd09c6a501fc7f09f66eff4b50dc5b559bb5afcbb458f5c8e635c8e
-
SHA512
5d5c2e02463a60a9fa13fd5a43b7b778fdd3bbee7ae88895808d841c60f1d4b6a7c65d00e364c5c319eb48888228ebac87d4385e354c16b1175cc92aa548502b
-
SSDEEP
24576:pEqr4MROxnF25bHKTlQMrZlI0AilFEvxHiqsH:pEjMiwMrZlI0AilFEvxHiq
Score
10/10
Malware Config
Extracted
Family
orcus
C2
192.168.159.129:9999
Mutex
92cc6c3d287f46f7a415789f518610a5
Attributes
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fc4dd137ffd09c6a501fc7f09f66eff4b50dc5b559bb5afcbb458f5c8e635c8e
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections