orcus | cd5b3e000f5313d4938eab87c510d113723d316cc3273dbbbb73f919a60e611a

General

Target

cd5b3e000f5313d4938eab87c510d113723d316cc3273dbbbb73f919a60e611a
Size

1.2MB
MD5

1b1aacc66dbfe0f0510a9b28db635030
SHA1

8c994aa138ff968020ac8b0132c2f442a63e5d8c
SHA256

cd5b3e000f5313d4938eab87c510d113723d316cc3273dbbbb73f919a60e611a
SHA512

91343ffc72c91b06a7dd0e4eee8325f53880c80db939df59d523d89282fdda227f70d94e89d37246d3edda780e1ceef38394e684c951c6fbbfb792c3cc4f3d71
SSDEEP

24576:h+S04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfzwIbt+r1:ha4auS+UjfU2T/5XDsIbt+r

Score

10^/10

rat laptop orcus

Family

orcus

Botnet

Laptop

C2

192.168.2.100

Mutex

5990f8b056f141ae9471f57bbb457551

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
03/21/2015 18:50:26
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNQA4ADUAOAA1AGUAZAAyADYAZQBjADQANAA1ADcANwA5ADEAMAAxAGYANgBjAGMAZQA0AGUAMwBjADEANwAyAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGEAMgA0AGUAYwBmADIAYwA5ADUAMQA0ADQAOABhAGMAYQBmAGQAOAA1ADAAOQA5ADcAYgBlAGQANQA3ADQANAABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIDQAMQAyADAAYwA0ADcAOQA4ADEAYQBkADQAZQBhADkAYgBkAGMAMwAyADQAZQAxAGEANQA4AGUAYgBlAGYAZQACAAYG
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd5b3e000f5313d4938eab87c510d113723d316cc3273dbbbb73f919a60e611a