orcus | 3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1

Sharing

Copy URL

Twitter E-mail

General

Target

3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1
Size

923KB
MD5

90aad458c97b7381972efdfb0b02c57e
SHA1

069220f73ef14d30816612450549ccd1faaca135
SHA256

3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1
SHA512

d6858685120dffac208cb8b7b90be0a3ade20984a9a4fb372ab4515f0f9fd57f52aabc630d272200294e35143bda3cfbb8b722c03852ea170493943c72ac1714
SSDEEP

12288:WipkuIqoE8Byn6497dG1lFlWcYT70pxnnaaoawGRVcTqSA+9rZNrI0AilFEvxHvd:6mV4MROxnFPLqrZlI0AilFEvxHiZ7u

Score

10^/10

orcus

Malware Config

Extracted

Family

orcus

92.240.245.161:8010

Mutex

c208a879463248e19a922162bedb3564

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcurs Rat Executable 1 IoCs

Processes:

resource yara_rule

sample orcus
Orcus family
orcus
Orcus main payload 1 IoCs

Processes:

resource yara_rule

sample family_orcus

resource	yara_rule
sample	orcus

resource	yara_rule
sample	family_orcus

Files

3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

52:d6:f1:3d:0c:d8:1a:7a
Certificate

Issuer

CN=Adobe Flash Player,O=Adobe Flash Player,L=Wors,C=US,1.2.840.113549.1.9.1=#0c0b41646f6265406d2e636f6d

Not Before

16-11-2017 00:00

Not After

16-11-2019 00:00

Subject

CN=Adobe Flash Player,O=Adobe Flash Player,L=Wors,C=US,1.2.840.113549.1.9.1=#0c0b41646f6265406d2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3d:47:d3:13:c9:60:59:63:5c:d0:c8:c8:85:44:05:fa:1f:e6:83:68
Signer

Actual PE Digest

3d:47:d3:13:c9:60:59:63:5c:d0:c8:c8:85:44:05:fa:1f:e6:83:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 899KB - Virtual size: 899KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

52:d6:f1:3d:0c:d8:1a:7aCertificate

Extended Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

3d:47:d3:13:c9:60:59:63:5c:d0:c8:c8:85:44:05:fa:1f:e6:83:68Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 899KB - Virtual size: 899KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 12B

52:d6:f1:3d:0c:d8:1a:7a
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

3d:47:d3:13:c9:60:59:63:5c:d0:c8:c8:85:44:05:fa:1f:e6:83:68
Signer

.text
Size: 899KB - Virtual size: 899KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 12B