General
-
Target
7d5a9ed595cb27651d91a53abc6670a76d32d7465c28e7044395402f9dad5a4c
-
Size
912KB
-
MD5
f48aabd1c6be6b533f4adf2e1a94c0c8
-
SHA1
1d6a0fc0fc8e4fb8c0db9645cd6a2399e1edee91
-
SHA256
7d5a9ed595cb27651d91a53abc6670a76d32d7465c28e7044395402f9dad5a4c
-
SHA512
0b0b3251166708bb8bbd3ff8da03c84c46869d09718309ffa79c9ead6a8c4b2f7ca5b998283253f8b6e578329250e93f19aac3c5f5aa121aa930354a70076c58
-
SSDEEP
24576:0am4MROxnFrFPurerrcI0AilFEvxHPtzoop:0OMiMerrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
nerof
C2
192.168.1.128:10134
Mutex
86599f770f964a1e975ea11dd9ca08de
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
7d5a9ed595cb27651d91a53abc6670a76d32d7465c28e7044395402f9dad5a4c
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections