General

  • Target

    c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d

  • Size

    3.0MB

  • MD5

    fb9c101e7ee4206d46e76123f639194c

  • SHA1

    5e83980f211ed8882cdbda90b374689d582e6cda

  • SHA256

    c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d

  • SHA512

    60c3f32a31ed8d83aa1d915ed0ee0accffe8a6e3e88accc5037334f499e0ce02313a20dba9236261ab1fbe56c6c5836cdab51545c0d7668b941af27f6031ca74

  • SSDEEP

    49152:yldN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmGWncFf0I74gu3AM:y90wGGzBjryX82uypSb9ndo9JCm

Score
10/10

Malware Config

Extracted

Family

orcus

C2

loocarpoint.duckdns.org:4782

Mutex

cc0d0b196e424f1bb95d117665f988e0

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\kate_is_famous_holy_fuck

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections