General
-
Target
45e4164efb64f0a589a567b3c9f5d41107c5d832729e6a7c50f76746566a4cfa
-
Size
914KB
-
MD5
90d13737114c302721421b0f8dd96fe5
-
SHA1
1c46d75f27aebd4876d723e8631a6c118d15b4cd
-
SHA256
45e4164efb64f0a589a567b3c9f5d41107c5d832729e6a7c50f76746566a4cfa
-
SHA512
613fe282f89113b71a8f971bb462fc7754a99e2a64a337d926090581344002676effb5fc006233d096a1e672d299bf084ba5e7394aa71a34391cbff8c2e63df7
-
SSDEEP
24576:ehg4MROxnFR3KTnsrZlI0AilFEvxHiMz:ehDMij/rZlI0AilFEvxHi
Score
10/10
Malware Config
Extracted
Family
orcus
C2
178.20.45.159:7777
Mutex
cebdd72cd8644d1887737526c4a60f8b
Attributes
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%appdata%\Discord\Discord.exe
-
reconnect_delay
10000
-
registry_keyname
Update
-
taskscheduler_taskname
Discord
-
watchdog_path
Temp\Radmin VPN.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
45e4164efb64f0a589a567b3c9f5d41107c5d832729e6a7c50f76746566a4cfa
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections