General
-
Target
c010f24789ecc04d92b1ba71d4633dc39f8eb4cc4a26e6f097b500f0414d4f59
-
Size
924KB
-
MD5
995bb10dc32aab55bcf4a5da69556b92
-
SHA1
6fa508312c4304cd0fda75440244e7829ddb0f85
-
SHA256
c010f24789ecc04d92b1ba71d4633dc39f8eb4cc4a26e6f097b500f0414d4f59
-
SHA512
b71eeed4f4873cac3064751c7afaa78c3b99c9190dd7df38078ae0fb77d308386b1b82da44373cb0757cd87de4606abe883b4296e708e873e70a5288c47f52de
-
SSDEEP
24576:p3d4MROxnFE3iirrrcI0AilFEvxHPIoo8:p6MiuVrrrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
testbuild1
C2
127.0.0.1:1268
Mutex
979c2ee9d7ff48d0a2e4e2df3c2c864d
Attributes
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Common Files\System\HD Audio\HDAudio.exe
-
reconnect_delay
10000
-
registry_keyname
HDAudioDriver
-
taskscheduler_taskname
HDAudioDriver
-
watchdog_path
AppData\HDAudioWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
c010f24789ecc04d92b1ba71d4633dc39f8eb4cc4a26e6f097b500f0414d4f59
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections