General
-
Target
fe27a5091ee443a0f1b5082d2bff21654a75ff029d5ebdaaa80b108d265725cd
-
Size
1.2MB
-
MD5
8031ba7c7db878cb3ddd3bf3f9bea80b
-
SHA1
58bff6171067acc0b51c5c61c04de60b036bbb5c
-
SHA256
fe27a5091ee443a0f1b5082d2bff21654a75ff029d5ebdaaa80b108d265725cd
-
SHA512
581fa0775baca47a48c4b14f186d085ea8c8f37e52faa516b4bcf5bd4958b3fbde0df8dcd5ed65163a928e58ef1c4ac2938d476920be7fd8e72d90f494658d11
-
SSDEEP
24576:+2A4MROxnFE30rXpCrZlI0AilFEvxHinYhrpo:+2jMiuepCrZlI0AilFEvxHig
Score
10/10
Malware Config
Extracted
Family
orcus
C2
127.0.0.1:7436
Mutex
851c13e9b18e43239c52719c67ae474f
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Windows Academy\quard.ai
-
reconnect_delay
10000
-
registry_keyname
svchost
-
taskscheduler_taskname
svchost
-
watchdog_path
AppData\quard.ai
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fe27a5091ee443a0f1b5082d2bff21654a75ff029d5ebdaaa80b108d265725cd
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections