Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 01:23
Behavioral task
behavioral1
Sample
1523a2cef2a26e9b25a3fc81ac28b56b9e7f18bbb86dfc993dc5e9987f024a71.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
General
-
Target
1523a2cef2a26e9b25a3fc81ac28b56b9e7f18bbb86dfc993dc5e9987f024a71.exe
-
Size
3.0MB
-
MD5
6eff14955f352840b8937f0dc1811e49
-
SHA1
1e9da08304611fe67b4e8454091d8c4c422392b1
-
SHA256
1523a2cef2a26e9b25a3fc81ac28b56b9e7f18bbb86dfc993dc5e9987f024a71
-
SHA512
56ab51d9e6f0a958e0aaf8ef4a8cdcfa49f362af733986c21580a9c6579dd097afad1af3b4704deb282bb3798710cfd8d8c47ba8c2fe5badfa574005da2e5f25
-
SSDEEP
49152:8flit1ZeM9/3EgHcyH4Z9fVTB4krLzS+HAypQxbOqUo9JnCmLPnGFfhIMdOup:8fEtGjzD5rfLgypSbKo9JCm
Malware Config
Extracted
Family
orcus
Botnet
VT
C2
91.227.18.174:443
Mutex
00019fe362dc4d06a7aaa7724afda437
Attributes
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe