General
-
Target
86c9768740b98bcb77204cf7457636abaeb90ae04395b12f0a2ac955bdf0eaf0
-
Size
917KB
-
MD5
1b5125205daeb3d17c29d81f5e525e53
-
SHA1
d6f373b925f7b1a5bbd1950b0bd4c926bf3a9c41
-
SHA256
86c9768740b98bcb77204cf7457636abaeb90ae04395b12f0a2ac955bdf0eaf0
-
SHA512
11647e18982e379e39e38203f29efa064ee8435b5eff0005d1576b0077fbcb7f95afa52166b021a8ac2f4adb9dd132f9ef060c3cc98d3797a6dd638d62d2f490
-
SSDEEP
24576:5U04MROxnFH3XRM4VrrcI0AilFEvxHPRYooX:5mMihXlVrrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Retard
C2
detoxify-21656.portmap.host:35923
Mutex
5d87dc1d65f54aca967b62380c79adea
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
C:\Program Files (x86)\Microsoft\svchost.exe
-
reconnect_delay
10000
-
registry_keyname
System.exe
-
taskscheduler_taskname
conhost.exe
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
86c9768740b98bcb77204cf7457636abaeb90ae04395b12f0a2ac955bdf0eaf0
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections