Overview

overview

10

Static

static

10

c5ad23faa6...2N.exe

windows7-x64

10

c5ad23faa6...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N

  • Size

    3.0MB

  • MD5

    5487d71c19c09ded835191e89feba640

  • SHA1

    6c13f1e61e8cf66ae728a53c49497899def41092

  • SHA256

    c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2

  • SHA512

    0d17303a9bc1903d298eb5d6cc8d1d36bfa1950c9fe14d8d03623381c5d4f75f5e6eb376474b4d67081906630459be4374a980992622515b3646170b8b8f6181

  • SSDEEP

    49152:dsFN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmwWncFf0I74gu3+SM:do0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

voidsystems.duckdns.org:23210

Mutex

db2de9eb436a494988e51052087353b5

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\KernelGuard\SafeGuard.exe

  • reconnect_delay

    10000

  • registry_keyname

    KernelEncryptionProtocolKEP

  • taskscheduler_taskname

    SafeGuard

  • watchdog_path

    AppData\KernelAntiLoopGuard

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections