Overview

overview

10

Static

static

10

nursultan crack.exe

windows7-x64

10

nursultan crack.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nursultan crack.exe

  • Size

    917KB

  • MD5

    120802a68926043553500b2521832a7c

  • SHA1

    18b9d5a66d650c6fc5bcf8f4401f0912d209f354

  • SHA256

    490e237dd1557759ef2f1f7ea188ffec35d01199483ba77d027b2b5d654d634d

  • SHA512

    b226c83e8d72292d56cd63f2b2192b80acbc7ba19c9c418f5d168e61886ab971b42abc9f0b9c85611af42ea6601a9d08b2066ca0a8b07a99ed1d1df54a052a85

  • SSDEEP

    24576:aVl64MROxnFi3erxrZlI0AilFEvxHi1kp:aVDMioe1rZlI0AilFEvxHi

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.56.1:7846

Mutex

ea591914ecaf493998021ae6da75d71b

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\pidor.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • nursultan crack.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections