Overview

overview

10

Static

static

10

87f7c9621a...2c.exe

windows7-x64

10

87f7c9621a...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87f7c9621a398d1463e9b6e095704ce6a1d63f55ba8a6c88fdbef6dca7e7232c

  • Size

    912KB

  • MD5

    40d323b48e02a159e2902bba5d60d585

  • SHA1

    a7e40602a8172e1f5f501e5400346724a7eb8ca1

  • SHA256

    87f7c9621a398d1463e9b6e095704ce6a1d63f55ba8a6c88fdbef6dca7e7232c

  • SHA512

    162b6fab5a760a94cead19f1d4b982a187ba08621ba495685a62e858714f1012ab25428e14eba72d82dcfa445a9805c42c52b1352e9ff44bba8579c07e103287

  • SSDEEP

    24576:Dam4MROxnFrFPurerrcI0AilFEvxHPmUFoop:DOMiMerrcI0AilFEvxHPmU

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.1.56:10134

Mutex

e9854b98f65745a89d715a85a4ff1de8

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 87f7c9621a398d1463e9b6e095704ce6a1d63f55ba8a6c88fdbef6dca7e7232c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections