Overview

overview

10

Static

static

10

4ee61198bf...c0.exe

windows7-x64

10

4ee61198bf...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ee61198bf5742ab2497f9034e73299052e4cf8d6f04ef72393f07ff8ca27dc0

  • Size

    917KB

  • MD5

    ee128fdc0c14610f0e94610332c8f189

  • SHA1

    d29af3db2e278549e22fa7b8bd939b581b34150c

  • SHA256

    4ee61198bf5742ab2497f9034e73299052e4cf8d6f04ef72393f07ff8ca27dc0

  • SHA512

    884fd9316c51a91c2fba4222bfed7a4667fffc056715cda7591d49ab26e2c161365451123b667ab6fe4a1269b139aeba6f02ee460173fda7b8cee8e10918e9fd

  • SSDEEP

    24576:2CC4MROxnFi33snrrcI0AilFEvxHPDooW:2KMiocnrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

live-promotions.gl.at.ply.gg:51701

Mutex

3c04931e3f454403ae52495677e37b6f

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4ee61198bf5742ab2497f9034e73299052e4cf8d6f04ef72393f07ff8ca27dc0
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections