Overview

overview

10

Static

static

10

b0cc453944...70.exe

windows7-x64

10

b0cc453944...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970

  • Size

    2.9MB

  • MD5

    1249e9396c0db740782bf81f4df9af36

  • SHA1

    9115861b4181e12ea6a2974df2beb8b06f91ef76

  • SHA256

    b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970

  • SHA512

    ab355529fc66b99d0521a013e062a17ffb6017e17ec67efa570d8080938a6b2540475058f8035a1b01179e593e1ff808e6116bde2b9ab44012e06576c031c1f9

  • SSDEEP

    49152:NXmN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmlWncFf0I74gu3Ts:NS0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.50.155:10134

Mutex

orcus_rat_______874d7e7d129c4b8594f95e8c03299577_1488_1488_1488_freeeeeee_robux

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b0cc453944dc427b9adfc3014d42acdc4a21f22c199c34e6f4d30057c318b970
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections