General
-
Target
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6
-
Size
917KB
-
MD5
8cfb9da9582d67319cbffb3d57c83d5c
-
SHA1
e452572577424d9740b07b3119c9442d46208a55
-
SHA256
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6
-
SHA512
fa92188051c9ff9720ca9ff4c9fd7b8672c192921f19aad956ad6253d3366b0f7c3379ea2b0b439fcaea301166644aab148528f338bbe74e52035fbefd55820f
-
SSDEEP
24576:W554MROxnFH3WIBM4irrcI0AilFEvxHPnTooe:WQMihWeirrcI0AilFEvxHPn
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Lesha
C2
127.0.0.1:1268
Mutex
1be714c0b4c0462db71afc6acd175bfc
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
29a095ca89e6d3c30244e182fb6a93cd83ca3baa9996ca5d852d3a9a60639ee6
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections