Overview

overview

10

Static

static

10

7a7daa96cf...4c.exe

windows7-x64

10

7a7daa96cf...4c.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c

  • Size

    15.0MB

  • MD5

    c9a729181d000d53b390da89f4d68d0c

  • SHA1

    b1ba9b1e69634202f596c31bd69d975f3ddf5298

  • SHA256

    7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c

  • SHA512

    04bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a

  • SSDEEP

    24576:1Zf4MROxnFaarrcI0AilFEvxHPG+qoot:1WMi5rrcI0AilFEvxHP

Score
10/10
ccorcus

Malware Config

Extracted

Family

orcus

Botnet

CC

C2

192.168.1.5:10134

Mutex

a9b4352a71bc43b0b7d8d88b859bf9a8

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\system\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    registy

  • taskscheduler_taskname

    wsappx

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections