General
-
Target
be1fc4a2177662175dee98c7c2acd740370c91979cf91f6e8294a47bb908e78c
-
Size
918KB
-
MD5
dbf06f8c7aac18054f713d4795f3b48f
-
SHA1
f6b4d693d2d39b8a3f61311b7c94d381583334c8
-
SHA256
be1fc4a2177662175dee98c7c2acd740370c91979cf91f6e8294a47bb908e78c
-
SHA512
043b0c84e6616376fd5830a85b03a5188bb1b752f94cdbd1f5b6bf88a4ace2a031a5365f7b45e147e3869945150ebbe1a92009852ba544fec7dca8d52318ea77
-
SSDEEP
24576:M554MROxnFZ3aIBM4+rrcI0AilFEvxHPGoov:MQMi7ae+rrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
тест
C2
192.168.101.102:37375
Mutex
931740ae9b854115addd9f6dfdf826c4
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
be1fc4a2177662175dee98c7c2acd740370c91979cf91f6e8294a47bb908e78c
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections