Overview

overview

10

Static

static

10

5b618ba9e3...8b.exe

windows7-x64

10

5b618ba9e3...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b618ba9e3a32f7980196311f12d2d283d9512d1e1a83d9c207d23acbaad018b

  • Size

    926KB

  • MD5

    5d7cfb4bf6a987ed92c77e51f58fde41

  • SHA1

    d75b0c92a09e5fe73df75d1850a4f625a257162f

  • SHA256

    5b618ba9e3a32f7980196311f12d2d283d9512d1e1a83d9c207d23acbaad018b

  • SHA512

    531c5fef50e4aa2220ac9bc0bda328a3348f01fce89c1fe7fb700cd01422f2b3e61335d7b4a1e54ca8abfeb23eb4765491f61aa5af52ff63ed5b19ecec788073

  • SSDEEP

    24576:vIY4MROxnFE38O3VrrcI0AilFEvxHPToox:vaMiuZVrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

tcp.cloudpub.ru:63094

Mutex

f809db9e18254c08a79e8950f3742790

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    Temp\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5b618ba9e3a32f7980196311f12d2d283d9512d1e1a83d9c207d23acbaad018b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections