General
-
Target
9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e
-
Size
2.0MB
-
MD5
cfbef968f6849584b09d80e9400831fb
-
SHA1
55dcd9883812008506b97913b357086bf83b35f2
-
SHA256
9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e
-
SHA512
f36b932f985a88101c173b33c68653c106dc34deb79653bac29cea8d48afb78570f1627a7259621a5dbaea5a69b4259d18a74f6564aaf5d272e16a9911359836
-
SSDEEP
12288:55STYf+qnR7Fkxh7dG1lFlWcYT70pxnnaaoawhmg6vgWrOrZNrI0AilFEvxHvBMI:fhg4MROxnFc645rZlI0AilFEvxHi70
Score
10/10
Malware Config
Extracted
Family
orcus
C2
185.154.14.217:10134
Mutex
8f9ad032680b48e4921e3dead6b0b2ce
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%appdata%\Java\javaUpdate.exe
-
reconnect_delay
10000
-
registry_keyname
JavaUpate
-
taskscheduler_taskname
JavaUpate
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections