General
-
Target
6bba215e483a2666f63ff43b8426d87b8f8803d2adaed2cbbe18cbf7ddd1654e
-
Size
916KB
-
MD5
6a03878d0a135ce5eb80056d6cf7a2ea
-
SHA1
f3af214dfe6fde176fba73861d8361cae311903c
-
SHA256
6bba215e483a2666f63ff43b8426d87b8f8803d2adaed2cbbe18cbf7ddd1654e
-
SHA512
a816f0ede1835c1855dabe728dad113f85202db94a2d124c68cac8a4cbdcdcef2591e9894573fface0862e9f54173c5eee2b2a657cbd36bc32d0ba228a6874e9
-
SSDEEP
24576:aam4MROxnFD3wrXYf1rrcI0AilFEvxHPpHcooZ:aOMiJJrrcI0AilFEvxHPp
Score
10/10
Malware Config
Extracted
Family
orcus
Botnet
dedik
C2
212.15.49.233:5050
Mutex
2880bbf8febd4a45abca9ad738f10173
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
-
Orcus family
-
Orcus main payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
6bba215e483a2666f63ff43b8426d87b8f8803d2adaed2cbbe18cbf7ddd1654e
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections