orcus | e1eee43f72d2ce8c71935da77eca912ce49200d7c7fb3eeff50ef7db679a0e65

General

Target

e1eee43f72d2ce8c71935da77eca912ce49200d7c7fb3eeff50ef7db679a0e65
Size

1.2MB
MD5

6ac4d105ae7156599332cfd8f445475d
SHA1

ba978d275b256ea181e8c0065b5a1542666fb385
SHA256

e1eee43f72d2ce8c71935da77eca912ce49200d7c7fb3eeff50ef7db679a0e65
SHA512

f00d9bee80e14b06e15f295559a77ad41ff0b088dddbb810515793a26f328f09f80f1bfa999758de281d19622afe4092da765bf029e82ab411f5b56d3164a30a
SSDEEP

24576:FrS04YNEMuExDiU6E5R9s8xY/2l/djJ5dtsPxNGfAkIbt+rM:Fh4auS+UjfU2T95XD4kIbt+r

Score

10^/10

rat orcus

Family

orcus

C2

192.168.2.23

Mutex

dcb67951d1bb44e998457562f4d27ec8

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\Microsoft Corporation.exe
installservice
false
keylogger_enabled
false
newcreationdate
09/25/2009 11:18:39
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgZQAyAGQANAAyADUANQA5ADMANgBjADkANABjAGYAZQA4ADQAZABkAGUANQBmADUAMQBmAGIAZgAzADgANAA1AAEFyOzBvwKV1wLetwKoxrcNilV/bBUKRwBhAG0AZQByACAAVgBpAGUAdwAHAzEALgAyAEEgNQBkADUAYwA4ADkAYwA1AGIAOQA0AGMANAA2ADEAMgBhADUAYQA0ADkAMQBlADIAZQBmADcAOAAyADkAZgBmAAIAAAQE
reconnect_delay
10000
registry_autostart_keyname
Microsoft Corporation
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
e1eee43f72d2ce8c71935da77eca912ce49200d7c7fb3eeff50ef7db679a0e65