General
-
Target
f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
-
Size
920KB
-
MD5
b08bc930dc90e54bc888a9b8195ecc12
-
SHA1
3019337f580bdc0c54c01a79e5144143fe10f17d
-
SHA256
f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
-
SHA512
c3b8f048730ce8a0ac767bcdf970189af6034a2a7e6e7360b111f83008b32665c4f6cc9e23e4cbe8228931f1a0a56bfe1c89a776aafbbe49b898814fe38c3f20
-
SSDEEP
24576:bwV4MROxnFZ3+kTZ1rZlI0AilFEvxHirXrD4:bwCMi7nrZlI0AilFEvxHir
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
fake2
C2
192.168.50.22:10134
Mutex
d4279019eb0e484a85ded599a3e44bc6
Attributes
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%appdata%\fake2\fake2.exe
-
reconnect_delay
10000
-
registry_keyname
fake2
-
taskscheduler_taskname
fakee2
-
watchdog_path
AppData\fake2.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections