Overview

overview

10

Static

static

10

f4d1839c9c...ee.exe

windows7-x64

10

f4d1839c9c...ee.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

  • Size

    909KB

  • MD5

    2e28ffac1bbd47f62d62afc8c73be052

  • SHA1

    069841377ae2f05b02e53964b64ae619b091fab3

  • SHA256

    f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

  • SHA512

    b000033344ff472cca72f4a471b5d000a7611bb05873305b36d320b2f89cef4aa19d61dd6e7af96ac7ecd5255ad0fd2589289b87bc7670ebaa9342f84519a1f2

  • SSDEEP

    24576:6kL94MROxnFOHrrcI0AilFEvxHPeroo3:hWMiMrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

192.168.31.232:8488

Mutex

c119ac29a86f4ba4957a5a8f07ffc34b

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections