General
-
Target
fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905
-
Size
903KB
-
MD5
1b1ed829d9d28de97a67b4deef9611fd
-
SHA1
f721c2092d2ea32270bdfd4e01e3af6f6d983730
-
SHA256
fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905
-
SHA512
6d05651ba20296ac8053322bbe4fe912d1d580b30202d4c047f9c6dfb4fcc45c0bec22223a11a7d0e741ae4572d4b5745e37f7abb14ee99f37b710a1b6760598
-
SSDEEP
12288:i0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCBfm9rR6W7BaepBwzo7dG1lFlWx:Xam4MROxnF4OVrrcI0AilFEvxHPOooh
Score
10/10
Malware Config
Extracted
Family
orcus
C2
0.tcp.ap.ngrok.io:14759
Mutex
e76402febf5a462e951739e787591097
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fcc17039e19352baffc536e8943d5ad788981046242eefe4d62912bfcb5f1905
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections