orcus | 74299c629170342b9340e5391807a8d153023a74610a6447a139a99949f0fdbc | Triage

Sharing

General

Target

74299c629170342b9340e5391807a8d153023a74610a6447a139a99949f0fdbc
Size

907KB
MD5

366bd710e27f2aa50dc056b05b6d57c6
SHA1

f22b0da1da5cdebc48dcc4ca4a54210b36ae9e1d
SHA256

74299c629170342b9340e5391807a8d153023a74610a6447a139a99949f0fdbc
SHA512

c1c4292545e1b94c2150226eda24b0c5edbefba5695f86e8143eacebe3197f493c782ee9cb09412010c7475199cceab502025d616ce3695635f707ac72a8ae87
SSDEEP

24576:Jj54MROxnFj3rrkxrrcI0AilFEvxHPIooT:JyMi1fqrrcI0AilFEvxHP

Score

10^/10

orcus

Malware Config

Extracted

Family

orcus

C2

35.202.161.174:8080

Mutex

5c75563d05504d81b7e68462b45e649f

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\Runtimers\Runtimer.exe
reconnect_delay
10000
registry_keyname
RuntimerHD
taskscheduler_taskname
RuntimerHD
watchdog_path
AppData\Runtimer32.exe

Signatures

Orcurs Rat Executable 1 IoCs

resource	yara_rule
sample	orcus

Orcus family
orcus

Orcus main payload 1 IoCs

resource	yara_rule
sample	family_orcus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74299c629170342b9340e5391807a8d153023a74610a6447a139a99949f0fdbc

Files

74299c629170342b9340e5391807a8d153023a74610a6447a139a99949f0fdbc
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 902KB - Virtual size: 902KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ