General
-
Target
b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6N
-
Size
915KB
-
MD5
dc9238b0734a5ef282d6a1497fc5e730
-
SHA1
2cc7368ab3de9f2b8eb33c60d8e8592bc96c16fb
-
SHA256
b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6
-
SHA512
5cb90f8940e82557feb182861ccd59168c1e75e9eb9cf3a83541701503bee31ddecdaf4f61db275572cbfcb07c2ba7c85817e4226e13a836153bd9b435b44900
-
SSDEEP
24576:IXqP4MROxnFD3h74S4xrZlI0AilFEvxHiNpx:IXjMiJ2rZlI0AilFEvxHiN
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
winzip
C2
z3roxl33t.hopto.org:7415
Mutex
676113f043a94b71a3b9dfa0e0dd63be
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\winzip data\winzip.exe
-
reconnect_delay
10000
-
registry_keyname
winzip service
-
taskscheduler_taskname
winzip services
-
watchdog_path
Temp\winzip.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6N
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections