General
-
Target
e9b5c460a6265592f78fb29b95bdd25fb4b91a5b6913384d24e5ca5cd57d7aa6
-
Size
904KB
-
MD5
0607b85b534f556fcb6f477072db166a
-
SHA1
fc8d0b79555ca080d96a202051bdb73718580cde
-
SHA256
e9b5c460a6265592f78fb29b95bdd25fb4b91a5b6913384d24e5ca5cd57d7aa6
-
SHA512
bff28785a7db1ee94a37b00979fcff1e766794d94a85c4785d30c8d7bc026a99588d4bad521076e7092d0374bdaa8cb54f1b6341c3c1a3fed64795ec4e639f74
-
SSDEEP
12288:M0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCucpCwFuCQaUepPToIp7dG1lFld:yU04MROxnFTHrrcI0AilFEvxHPAjooe
Score
10/10
Malware Config
Extracted
Family
orcus
C2
b7fscoc.localto.net:8935
Mutex
cf06369f7b98472f97643448b3df76ba
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%appdata%\Roaming\am1\RuntimeBroker.exe
-
reconnect_delay
10000
-
registry_keyname
RuntimeBroker
-
taskscheduler_taskname
RuntimeBroker
-
watchdog_path
AppData\Runtime.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
e9b5c460a6265592f78fb29b95bdd25fb4b91a5b6913384d24e5ca5cd57d7aa6
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections