Overview

overview

10

Static

static

10

11.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11.exe

  • Size

    3.0MB

  • MD5

    43c28623704ec7dcb908347eeefba65e

  • SHA1

    96a5529786a22108c20287e5bb8dda5241435d53

  • SHA256

    d8f7ae1fdf4d2ceec1b8eeb8f88c6fbfe48c42ac79deaab79474a647ebed8868

  • SHA512

    362482c3179bf8b5dd8eb255af6d8d3b4233a934d082ea9241fb725f7c6101e28962d7c4749c9af886218d6c25ad3f60557eb759a1d00db079e4439058a24ce5

  • SSDEEP

    49152:APZonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCm2WncFf0I74q:APCFmwLvEeMDjnpHfP56xypSb1o9JCm

Score
10/10
zombie niggerorcus

Malware Config

Extracted

Family

orcus

Botnet

Zombie Nigger

C2

192.168.100.3:4444

Mutex

954b6020281f40579bd830bb66bf6d92

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    C:\Windows\System32\System32BootManger\scvhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    update

  • taskscheduler_taskname

    system32

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 11.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections