Overview

overview

10

Static

static

10

844723fe8d...4c.exe

windows7-x64

10

844723fe8d...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c

  • Size

    3.0MB

  • MD5

    a926645c212cd8d7667b2c0d91421bf8

  • SHA1

    042a63bb3bbdb79d81dc21b9517b213fa16ee9d4

  • SHA256

    844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c

  • SHA512

    8c2557ff2bcd730f4a99306b19a6b05aaa30a2fc74d77a5d2c4f246bc12edb65c8acb270ce7e0016ea1884ddf9f3268403fc60f498fc6fae927d201aaa20e488

  • SSDEEP

    24576:wpP4MROxnFH3yRM4qrrcI0AilFEvxHPcdooV:w2MihylqrrcI0AilFEvxHPc

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

venerra.ddns.net:1604

Mutex

8f144d586f97404d9cf70aca18e3708d

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %windir%/VMP/Protector/VMP Demo.exe

  • reconnect_delay

    10000

  • registry_keyname

    VMP Protect

  • taskscheduler_taskname

    VMP_Protect

  • watchdog_path

    AppData\VMP Https

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 844723fe8d0dba68effa0969216be3c67133019f720396c47c8f57752d9c014c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections