General
-
Target
6ef3cd890eab784877e7a5d3a1a1a85ddc1198e6e75d92dfbf3d7b5387ab4ebd
-
Size
917KB
-
MD5
95739e0759b1a44d395b89d52877be4c
-
SHA1
ea1839130a38aadae8dfc7ed044e93ec045ca849
-
SHA256
6ef3cd890eab784877e7a5d3a1a1a85ddc1198e6e75d92dfbf3d7b5387ab4ebd
-
SHA512
d1a2941a33919b55125d1bebb01953961446f0d83cfd67f54d847d847fc2f36d7f7a49fc35a70e64aa83af293103064dead3658b97c428644f9ae77499871a96
-
SSDEEP
24576:aVr4MROxnFi32s2rrcI0AilFEvxHPmoon:aWMion2rrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
Text
C2
192.168.0.20:9999
Mutex
83c441d6c7f14e0aa6501ceeca4f9280
Attributes
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
6ef3cd890eab784877e7a5d3a1a1a85ddc1198e6e75d92dfbf3d7b5387ab4ebd
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections