Overview

overview

10

Static

static

10

1895ea7718...60.exe

windows7-x64

10

1895ea7718...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1895ea7718500dfd7ddf4ccbf5057816fc06f849e72e644ba72c57f6241ca860

  • Size

    3.0MB

  • MD5

    5061282fe58821440585f7bbb1708423

  • SHA1

    f64e5554bd39d34f872f9e74bef2b6bdcdb5541d

  • SHA256

    1895ea7718500dfd7ddf4ccbf5057816fc06f849e72e644ba72c57f6241ca860

  • SHA512

    3ad7f99cba8fded3c1be9c3ee3611308915eedaea18ec9c02b7ef245d2cd4bb7caab8cb15f50db00f64eb4c6c2ac180feeb7fc5d4f91caab0943c2e1fbb3d61d

  • SSDEEP

    49152:Y02N8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmFWncFf0I74gu3tM:Yd0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.50.155:10134

Mutex

5c4ed961518e4098bff05128f1a5b804

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\sistem\sistem.exe

  • reconnect_delay

    10000

  • registry_keyname

    sistem

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1895ea7718500dfd7ddf4ccbf5057816fc06f849e72e644ba72c57f6241ca860
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections