orcus | 715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f

General

Target

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f
Size

841KB
MD5

4a667433343828c12e9c5679f707db74
SHA1

1ef28cff2d80369bece4b28b88beaf52342cc62a
SHA256

715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f
SHA512

c03b335895ac4a0ae9825000c4ef9d73f67e0a9475556567fdfe547ab9f03fbfa9c63a1a4db8b3cf89ddfa36b8db37d178fd3bfa3c5945519e20ef06493690b9
SSDEEP

24576:muS04YNEMuExDiU6E5R9s8xY/2l/df6Ibt+rH:mq4auS+UjfU2Tf6Ibt+r

Score

10^/10

rat orcus

Family

orcus

C2

192.168.2.23

Mutex

4bf07e4ada0b440f9979ca0174f03a7a

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
C:\Windows.old\WINDOWS
installservice
false
keylogger_enabled
false
newcreationdate
09/15/2021 17:22:19
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMgAwADgAZQAyADEAMQAxADAAYgBlAGYANAA1AGUAOABhAGYAZgAzADAAMQA4ADEAMAA2AGIAZAAwADkANABkAAEAAAACAg==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
715b4f18f85cbea590cb0a124c8653671d954c6cab3d81a3c570140b69ee6c1f