Overview

overview

10

Static

static

10

2160-373-0...ry.exe

windows7-x64

2160-373-0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2160-373-0x0000000000430000-0x0000000000834000-memory.dmp

  • Size

    4.0MB

  • MD5

    b0362d9bfb56734e5a1f66f2601b87cc

  • SHA1

    05bc4174608e6b2b2af21694b0f700523cb197be

  • SHA256

    5b14d0fc07ccb9e74976e29180634bf293e170314711eb74aa703e8b369c3e89

  • SHA512

    ce9cc4bd977cc98b348e49e031b7bd70327b1bcaa03839414be2ad49f94fdd4e7196937c1dccd07a780334077637801ef8692564a9cf98e462f33c535ad5c20f

  • SSDEEP

    98304:XLNuSZTKA0t9FFPEM9lwDwLmf6/MO4MypSbhso9JCmk:9bk9fcwlwDw860O4MypSbJC7

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

45.74.38.211:4782

Mutex

7a9c0f279c464958aebbd585f20f1cf2

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2160-373-0x0000000000430000-0x0000000000834000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections