Overview

overview

10

Static

static

10

803b7beb60...84.exe

windows7-x64

10

803b7beb60...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    803b7beb60fc189e23b02d5566e1aa76586997e87a7bb8ae098472763aa2d784

  • Size

    919KB

  • MD5

    94a89357e2c52568a401719ad73960f6

  • SHA1

    3e8b1ec202f0950734c4c8e6e8c08518321af34b

  • SHA256

    803b7beb60fc189e23b02d5566e1aa76586997e87a7bb8ae098472763aa2d784

  • SHA512

    cb66453f71e2e10c1a41de4d5e476e06ed6c4fa97df49f9e6c307c2f732439b1ed52ed8b8662c75c227b8df8a605e7549577035321df87c3eedc0deece658968

  • SSDEEP

    24576:BEu4MROxnFZ3vRM4urrcI0AilFEvxHPdoo9:BIMi7vlurrcI0AilFEvxHP

Score
10/10
eclipseogorcus

Malware Config

Extracted

Family

orcus

Botnet

EclipseOG

C2

45.138.16.68:53

Mutex

f9839e172b7b4b22ba8cd061593022cf

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\EdgeMicrosoftBrowser\Edge.exe

  • reconnect_delay

    10000

  • registry_keyname

    EdgeBrowserMicosoftUpdaterh

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\EdgeBrowser.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 803b7beb60fc189e23b02d5566e1aa76586997e87a7bb8ae098472763aa2d784
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections