General
-
Target
68c2573d2ba5a1f845aa42a24a63542fb8f8a97bc2223cb3d7f4cb674aa190b2
-
Size
924KB
-
MD5
b9941c3d4dbe7b3a7a74517ca5577e81
-
SHA1
ac5d234b16377491c3891dec2a628d2f13a5b6c5
-
SHA256
68c2573d2ba5a1f845aa42a24a63542fb8f8a97bc2223cb3d7f4cb674aa190b2
-
SHA512
01aed78d3b15e49c723a5c09caf8003d548d6fbc166fec989b0795f2723868d75c3a1bcd936115f0163d7750d50ec8c297a7b784851556c419b4869e178afc25
-
SSDEEP
12288:e0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNC7JsLdn487Rhp2sxuw7dG1lFlWK:bJ14MROxnFE3sFrrcI0AilFEvxHjUQf
Score
10/10
Malware Config
Extracted
Family
orcus
C2
147.185.221.229:56094
Mutex
2e76dc04b91f4090b8ce38a21dda6ce7
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\svhost\svhost.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\svhost.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
68c2573d2ba5a1f845aa42a24a63542fb8f8a97bc2223cb3d7f4cb674aa190b2
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections