Behavioral task
behavioral1
Sample
c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d.exe
Resource
win7-20240221-en
General
-
Target
c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d
-
Size
3.0MB
-
MD5
fb9c101e7ee4206d46e76123f639194c
-
SHA1
5e83980f211ed8882cdbda90b374689d582e6cda
-
SHA256
c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d
-
SHA512
60c3f32a31ed8d83aa1d915ed0ee0accffe8a6e3e88accc5037334f499e0ce02313a20dba9236261ab1fbe56c6c5836cdab51545c0d7668b941af27f6031ca74
-
SSDEEP
49152:yldN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmGWncFf0I74gu3AM:y90wGGzBjryX82uypSb9ndo9JCm
Malware Config
Extracted
orcus
loocarpoint.duckdns.org:4782
cc0d0b196e424f1bb95d117665f988e0
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\kate_is_famous_holy_fuck
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule sample orcus -
Orcus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d
Files
-
c9e013f2006038b22d258f6d487afab62029c5d0c71a7ce8af85ae4ac00a444d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ